fix(extractor): narrow .call/.apply/.bind skip in extractCallbackReferenceCalls

[carlos-alm]

Summary

• For .call() / .apply() / .bind(): all arguments are absorbed into the delegated function's parameter scope — none are direct callbacks of the calling function. This PR skips all arguments immediately for all three, eliminating false-positive dynamic call edges.
  • .call(thisArg, arg1, …) and .apply(thisArg, argsArray): the first arg is the this context; remaining args flow into the delegated function, not the current scope.
  • .bind(thisArg, arg1, …): all args are absorbed into the partial application.
  • This-rebinding (fn::this → ctx) continues to be handled separately by extractThisCallBindingsWalk.

Previously, identifier arguments were unconditionally emitted for .call()/.apply() calls, causing this-context arguments (and subsequent positional args) to be treated as dynamic callbacks. This produced false-positive call edges.

Test plan

• New unit tests in tests/parsers/javascript.test.ts cover: .call() emits nothing; .apply() emits nothing; .call() with only this-context emits nothing; .bind() emits nothing
• All parser tests pass
• Resolution benchmark precision stays at 1.0 (no new false positives)

Closes #1406

[greptile-apps]

Greptile Summary

This PR documents and tests the .call()/.apply()/.bind() early-exit guard in extractCallbackReferenceCalls that was applied in a prior commit (3ab27b6). All arguments to these three methods are skipped so they are never emitted as false-positive dynamic call edges in the current function's scope.

• src/extractors/javascript.ts: Adds a JSDoc paragraph explaining why .call()/.apply()/.bind() arguments are suppressed and appends a blank line after the early return — the guard itself (return []) was already present.
• tests/parsers/javascript.test.ts: Adds four negative-assertion tests verifying that identifiers passed to .call(), .apply(), and .bind() are never emitted as callback references.

Confidence Score: 5/5

Safe to merge — the change is documentation and tests only; the behaviour-changing guard was already committed.

The only lines changed in the extractor are a JSDoc block and a blank line. The four new tests are well-scoped negative assertions that correctly reflect the intended semantics for all three methods.

No files require special attention.

Important Files Changed

Filename	Overview
src/extractors/javascript.ts	Adds JSDoc paragraph and blank-line formatting to extractCallbackReferenceCalls; the underlying early-return guard for .call/.apply/.bind was committed in a prior commit (3ab27b6) and appears here as unchanged context.
tests/parsers/javascript.test.ts	Adds four negative-assertion tests covering .call(), .apply(), .call() with only thisArg, and .bind(); all use not.toContainEqual to confirm no identifiers are emitted as dynamic call edges.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[extractCallbackReferenceCalls] --> B{calleeName?}
    B -->|'call' / 'apply' / 'bind'| C["return [] — no edges emitted\n(args belong to delegated fn scope)"]
    B -->|other callee| D{Is calleeName in CALLBACK_ACCEPTING_CALLEES?}
    D -->|yes| E{Is calleeName in HTTP_VERB_CALLEES?}
    E -->|yes| F{First arg is string literal?}
    F -->|yes| G[memberExprArgsAllowed = true]
    F -->|no| H[memberExprArgsAllowed = false]
    E -->|no| G
    D -->|no| H
    G --> I[Emit identifier args + member-expr args]
    H --> J[Emit identifier args only]
    C -.->|this-rebinding handled separately| K[extractThisCallBindingsWalk]

Loading

_{Reviews (11): Last reviewed commit: "Merge branch 'main' into fix/narrow-call..." | Re-trigger Greptile}

[greptile-apps]

.apply() second argument incorrectly emitted as a callback. Unlike .call(thisArg, arg1, arg2, …), .apply() takes exactly two arguments: thisArg and a single argsArray. The array argument is never a direct callback — it is the arguments to spread into the target function. Emitting an identifier second arg (e.g. Math.max.apply(null, numbers)) will produce a false-positive dynamic call edge to numbers, exactly the kind of noise this PR is intended to eliminate. .apply() should be treated the same as .bind() and bail out immediately.

Suggested change

	// .bind() absorbs all arguments into a partially-applied function — no direct callbacks.
	if (calleeName === 'bind') return [];
	const skipFirstArg = calleeName === 'call' || calleeName === 'apply';
	// .bind() and .apply() absorb all arguments — no direct callbacks.
	// .apply(thisArg, argsArray): argsArray is a single array, never a callback.
	if (calleeName === 'bind' || calleeName === 'apply') return [];
	const skipFirstArg = calleeName === 'call';

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[carlos-alm]

Fixed — .apply() now returns [] immediately alongside .bind(). The JSDoc comment above the function has also been updated to explain that .apply(thisArg, argsArray) never carries a direct callback. Committed in 3ab27b6.

[greptile-apps]

Test validates the false-positive .apply() behavior. fn.apply(ctx, handler) passes handler as the arguments array, not as a callback. The test asserting that handler is emitted confirms incorrect behavior — if the extractor fix above is applied, this test should instead assert nothing is emitted (mirroring the .bind() test).

Suggested change

	it('emits identifier args after the this-context for .apply()', () => {
	const symbols = parseJS(`fn.apply(ctx, handler);`);
	expect(symbols.calls).toContainEqual(
	expect.objectContaining({ name: 'handler', dynamic: true }),
	);
	expect(symbols.calls).not.toContainEqual(expect.objectContaining({ name: 'ctx' }));
	});
	it('emits nothing for .apply() — second arg is an arguments array, not a callback', () => {
	const symbols = parseJS(`fn.apply(ctx, handler);`);
	expect(symbols.calls).not.toContainEqual(expect.objectContaining({ name: 'handler' }));
	expect(symbols.calls).not.toContainEqual(expect.objectContaining({ name: 'ctx' }));
	});

[carlos-alm]

Fixed — the test now asserts that neither handler nor ctx is emitted for .apply(), mirroring the .bind() test. Committed in 3ab27b6.

[github-actions]

Codegraph Impact Analysis

1 functions changed → 6 callers affected across 1 files

• extractCallbackReferenceCalls in src/extractors/javascript.ts:2914 (6 transitive callers)

[carlos-alm]

@greptileai

[carlos-alm]

@greptileai

[carlos-alm]

Addressed the PR description mismatch flagged in the Greptile summary: the description previously claimed .call() would still emit subsequent callback args (e.g. forEach.call(arr, handler) → emits handler), which contradicted the actual implementation (commit 3ab27b6 made all three return []). The PR description has been updated to accurately reflect that .call(), .apply(), and .bind() all skip all arguments entirely, with the rationale explained inline.

[carlos-alm]

@greptileai