JS: Hoist function decls in a block to the top of the block

Author: asgerf

javascript/extractor/src/com/semmle/js/extractor/CFGExtractor.java

@@ -1255,9 +1255,12 @@ public Void visit(Literal nd, SuccessorInfo i) {
 
     @Override
     public Void visit(BlockStatement nd, SuccessorInfo i) {
-      if (nd.getBody().isEmpty()) writeSuccessors(nd, i.getAllSuccessors());
-      else writeSuccessor(nd, First.of(nd.getBody().get(0)));
-      visitSequence(nd.getBody(), i.getAllSuccessors());
+      // Hoist function declarations in a block statement to the top of the block.
+      // This reflects non-standard behaviour implemented by most engines.
+      // See also: EcmaScript "B.3.2 Block-Level Function Declarations Web Legacy Compatibility Semantics".
+      List<Identifier> hoisted = HoistedFunDecls.of(nd.getBody());
+      hoistedFns.addAll(hoisted);
+      writeSuccessors(nd, visitSequence(hoisted, nd.getBody(), i.getAllSuccessors()));
       return null;
     }
 

javascript/ql/test/library-tests/CallGraphs/AnnotatedTest/Test.expected

@@ -2,7 +2,6 @@ spuriousCallee
 missingCallee
 | constructor-field.ts:40:5:40:14 | f3.build() | constructor-field.ts:13:3:13:12 | build() {} | -1 | calls |
 | constructor-field.ts:71:1:71:11 | bf3.build() | constructor-field.ts:13:3:13:12 | build() {} | -1 | calls |
-| hoisted.js:20:9:20:11 | f() | hoisted.js:23:9:23:23 | function f() {} | -1 | calls |
 badAnnotation
 accessorCall
 | accessors.js:12:1:12:5 | obj.f | accessors.js:5:8:5:12 | () {} |