minifier: invalid inlining of object compare into ternary condition

[raoz]

Describe the bug

Comparison of objects that implement a comparable toString is inlined into a condition that is checked after mutating the objects.

Input code

class Container {
    constructor(v) {
        this.a= v;
    }
    add(x) {
        this.a += x;
    }
    toString() {
        return this.a.toString();
    }
};
let x = Math.random();
let a = new Container(x);
let b = new Container(x+1);
let comp = a < b;
while (a < b) {
    a.add(1);
}
console.log(comp ? "smaller" :"not smaller");

Config

{
  "jsc": {
    "parser": {
      "syntax": "ecmascript",
      "jsx": false
    },
    "target": "es2015",
    "loose": false,
    "minify": {
      "compress": {
        "arguments": false,
        "arrows": true,
        "booleans": true,
        "booleans_as_integers": false,
        "collapse_vars": true,
        "comparisons": true,
        "computed_props": true,
        "conditionals": true,
        "dead_code": true,
        "directives": true,
        "drop_console": false,
        "drop_debugger": true,
        "evaluate": true,
        "expression": false,
        "hoist_funs": false,
        "hoist_props": true,
        "hoist_vars": false,
        "if_return": true,
        "join_vars": true,
        "keep_classnames": false,
        "keep_fargs": true,
        "keep_fnames": false,
        "keep_infinity": false,
        "loops": true,
        "negate_iife": true,
        "properties": true,
        "reduce_funcs": false,
        "reduce_vars": false,
        "side_effects": true,
        "switches": true,
        "typeofs": true,
        "unsafe": false,
        "unsafe_arrows": false,
        "unsafe_comps": false,
        "unsafe_Function": false,
        "unsafe_math": false,
        "unsafe_symbols": false,
        "unsafe_methods": false,
        "unsafe_proto": false,
        "unsafe_regexp": false,
        "unsafe_undefined": false,
        "unused": true,
        "const_to_let": true,
        "pristine_globals": true
      },
      "mangle": false
    }
  },
  "module": {
    "type": "es6"
  },
  "minify": false,
  "isModule": true
}

Playground link (or link to the minimal reproduction)

https://play.swc.rs/?version=1.3.100&code=H4sIAAAAAAAAA21QzQrCMAy%2BC75D2KkiFLyqw4NnTz5B1pVt0DXSZj8ge3fb%2FTiG5pLk%2B4EvUQa9hztZxspqB%2B%2F9DkIpsp5do5icaA8LGovLyktMob1M2DA1zHPR%2FxHCMYV%2BK2V6sqtsITZyp7lxdnbJVbN6hzAazdBDCg%2FkUjq0OdWjJOIYcKu79ZgQaKayX%2Bp4WkhF9SvwCFfIAtSVldEgxvWbEGU8cLSEJPE7ZLQ0VIjRfYPE12iMdgmcE0sMyxodH01nSMpkAQAA&config=H4sIAAAAAAAAA32VS3LbMAyG9z6FR%2Bsu2s4kixwgu56BQ4uQDJcPDQE61mR890Ivx21B7SR8ACH%2BeOjzcDw2F2qbt%2BOnPMrLYDNBfryLhcbI9iaWBtpgqc04cPNtoxeaUGc9wWy6L6Rhm3vgOYp%2Bfv%2FxskY0PiWCLWK1BYzYjc852xSGDERPNrHKkSVAZPo7fmU5fWjglJIHG%2FeQsWQwMvSQNbc2eW8HAnO1FR5ENaSkJploYXBmyGnQHaJDxhTFrmAH1pk2OdAYZmgZr6AGSj4JjCSXrGEHp9L3c73%2F5XC1vljWQuE2F0c%2BWYHnhMSmK6oYC6wpsdCKytiZDFyylhOjxzh9KefybL8kjLXzfgOIPN4SRRtUAWePTpquDndDMXbS2DwqXKZAVSBCL5IbxE7TfdINMqOaMoMrLUzCtzu4IgahAwNdJ92k4g%2Fk9qym5XGA1GlEOsCq11iAqU7syqfB2cHvclHWW3D1CJbPdUpjOCV14rZw4HNyOw5SDk51nGWf3IY6L9GBNAg41aWQCqZ5ZsPJ%2BHm5%2Ft8hMkFypul9Oun7ZJCOnyv5utruj10ebOy%2FdsWyzg%2BrQxOSKzNcfxRT4Zf1%2Ftp8OW2b%2FJG1Qfq1RU7Tebj%2FAYuPbut0BgAA

SWC Info output

No response

Expected behavior

The check a < b is performed before a is modified. Output should be "smaller"

Actual behavior

The check is done after a is modified. Output is "not smaller"

Version

1.3.100

Additional context

Setting minify.compress.inline to false avoids the issue (but is not sufficient for avoiding the issue with default compress configuration); inline:false and collapse_vars:true or reduce_vars:true also reproduces the issue.

[swc-bot]

This closed issue has been automatically locked because it had no new activity for a month. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.