Merge pull request #6459 from erik-krogh/oreq

Approved by asgerf

javascript/extractor/src/com/semmle/js/extractor/CFGExtractor.java

@@ -1659,7 +1659,7 @@ public class CFGExtractor {
 
     @Override
     public Void visit(AssignmentExpression nd, SuccessorInfo i) {
-      // `a &&= b` expands to `a || (a = b);`
+      // `a &&= b` expands to `a && (a = b);`
       // The CFG is a conditional assignment, so we go through the assignment `nd` last.
       if ("&&=".equals(nd.getOperator()) || "||=".equals(nd.getOperator()) || "??=".equals(nd.getOperator())) {
         if ("&&=".equals(nd.getOperator())) {
@@ -1673,7 +1673,7 @@ public class CFGExtractor {
           visitWithSuccessors(nd.getLeft(), union(First.of(nd.getRight()), i.getAllSuccessors()));
         }
         
-        visitWithSuccessors(nd.getRight(), First.of(nd)); // from right to assignment.
+        visitWithSuccessors(nd.getRight(), nd); // from right to assignment.
 
         writeSuccessors(nd, i.getGuardedSuccessors(nd));
       } else {

javascript/extractor/tests/es2021/output/trap/assign.js.trap

@@ -556,7 +556,7 @@ hasLocation(#20168,#20109)
 successor(#20161,#20164)
 successor(#20164,#20165)
 successor(#20164,#20168)
-successor(#20165,#20164)
+successor(#20165,#20162)
 successor(#20162,#20168)
 successor(#20156,#20159)
 #20169=*
@@ -569,7 +569,7 @@ hasLocation(#20170,#20093)
 successor(#20170,#20160)
 successor(#20159,#20169)
 successor(#20159,#20170)
-successor(#20160,#20159)
+successor(#20160,#20157)
 successor(#20157,#20161)
 successor(#20151,#20154)
 #20171=*
@@ -582,7 +582,7 @@ hasLocation(#20172,#20085)
 successor(#20172,#20156)
 successor(#20154,#20171)
 successor(#20154,#20172)
-successor(#20155,#20154)
+successor(#20155,#20152)
 successor(#20152,#20156)
 successor(#20141,#20147)
 successor(#20150,#20143)
@@ -601,7 +601,7 @@ hasLocation(#20174,#20063)
 successor(#20174,#20134)
 successor(#20139,#20173)
 successor(#20139,#20174)
-successor(#20140,#20139)
+successor(#20140,#20137)
 successor(#20137,#20134)
 successor(#20136,#20139)
 successor(#20134,#20141)

javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll

@@ -1495,6 +1495,16 @@ module DataFlow {
       predExpr = succExpr.(NonNullAssertion).getExpression()
       or
       predExpr = succExpr.(ExpressionWithTypeArguments).getExpression()
+      or
+      (
+        succExpr instanceof AssignLogOrExpr or
+        succExpr instanceof AssignLogAndExpr or
+        succExpr instanceof AssignNullishCoalescingExpr
+      ) and
+      (
+        predExpr = succExpr.(CompoundAssignExpr).getLhs() or
+        predExpr = succExpr.(CompoundAssignExpr).getRhs()
+      )
     )
     or
     // flow from 'this' parameter into 'this' expressions

javascript/ql/test/query-tests/Statements/UselessConditional/oreq.js

@@ -0,0 +1,17 @@
+function f() {
+    let foo;
+    if (bar) foo ||= [];
+    if (foo);
+};
+
+function g() {
+    let foo;
+    if (bar) foo ??= [];
+    if (foo);
+};
+
+function h() {
+    let foo = true;
+    if (bar) foo &&= false;
+    if (foo);
+}