[Compiler] Fix nullable property hoisting from deferred closures

[jarstelfox]

Summary

Fixes #34752, #34194, #35762

The bug

The compiler hoists property accesses from inside closures (event handlers, hook callbacks, returned functions) into memoization cache key checks that run during render. When the base object is nullable, this causes a runtime TypeError — even though the user's source code is perfectly safe.

For example, given this component:

function Component({ user }: { user: User | null }) {
  const handleClick = () => {
    console.log(user.name); // Safe — only runs on click
  };
  if (!user) return null;
  return <button onClick={handleClick}>{user.name}</button>;
}

The source code is correct: handleClick is only reachable after the if (!user) return null guard, and user.name in the JSX is also guarded. But the compiler generates:

function Component(t0) {
  const { user } = t0;
  // Cache check runs unconditionally during render:
  if ($[0] !== user.name) {  // TypeError when user is null
    $[0] = user.name;
    $[1] = <button onClick={handleClick}>{user.name}</button>;
  }
  return $[1];
}

The compiler saw user.name inside handleClick, concluded that user must be non-null, and hoisted that property access into a render-time cache key. But handleClick doesn't run during render — it runs later when the user clicks. The non-null assumption is invalid.

This same bug manifests in several patterns:

• Optional chains in render stripped to non-optional (user?.name becomes user.name in cache keys)
• Nullable state accessed in useEffect/useCallback callbacks
• Nullable props accessed in returned functions
• Deep property paths on nullable objects (user.company.name in a handler)

Root cause

getAssumedInvokedFunctions in CollectHoistablePropertyLoads.ts builds a set of inner functions whose property accesses are treated as proof of non-null at render time. The problem: it put all inner functions into a single set — both functions that genuinely execute during render (direct calls like const v = fn()) and functions that execute later (JSX event handlers, hook callbacks, returned functions).

collectNonNullsInBlocks then walked into every "assumed invoked" function, collected all property accesses as assumedNonNullObjects, and propagated them to the outer render scope. This told downstream passes that user was unconditionally non-null, which:

1. Caused reduceMaybeOptionalChains to strip ?. to . in dependency paths
2. Caused DeriveMinimalDependenciesHIR to use user.name (deep path) instead of user (truncated path) as the cache key
3. Caused codegenDependency to emit user.name as a non-optional cache key check

The fix (two parts)

Part 1: Split sync vs deferred invocation (CollectHoistablePropertyLoads.ts)

Split assumedInvokedFns into two categories:

• syncInvoked: Direct function calls (const v = fn()) — these execute during render, so if they access user.name, that does prove user is non-null at render time. Safe to propagate assumedNonNullObjects to the outer scope.
• deferredInvoked: JSX props/children (<Btn onClick={fn}>), hook arguments (useEffect(fn)), returned functions (return fn) — these execute later, so their property accesses tell us nothing about render-time nullability. NOT safe to propagate as non-null proofs.

Both categories are still recursed into for their own internal scope memoization — a deferred closure still gets its own optimized cache keys internally. The only change is that deferred closures no longer leak their non-null assumptions outward.

The transitive closure also respects categories: if a sync function calls another function, that callee is sync. If a deferred function calls another function, that callee is deferred. If a function is reachable from both, sync wins (it does execute during render).

Part 2: Preserve fine-grained cache keys via optional access (DeriveMinimalDependenciesHIR.ts)

After Part 1, deferred closure dependency paths would be truncated to the base object (e.g. user.name becomes just user in the cache key). This is safe but loses memoization granularity — if a parent re-creates the user object on every render but user.name stays "Alice", the cache would miss every time with user (reference equality) but would hit with user.name (value equality).

To preserve fine-grained memoization, deferred closure property paths are now tracked in a separate deferredNonNullObjects set that flows through BlockInfo and into ReactiveScopeDependencyTreeHIR as a secondary hoistable tree. When addDependency() would normally truncate a path because the base isn't in the main hoistable tree, it checks the deferred tree as a fallback. If the path exists there, it emits optional access instead of truncating:

// Before (crashes):
if ($[0] !== user.name) {

// After Part 1 only (safe but coarse — reference equality):
if ($[0] !== user) {

// After Part 2 (safe AND fine-grained — value equality via optional access):
if ($[0] !== user?.name) {

user?.name evaluates to undefined when user is null (no crash), and still tracks changes to user.name specifically when user is non-null (fine-grained memoization).

This improvement is scoped to deferred closures only. Render-time truncation (e.g. try-catch blocks, jump-poisoned scopes) is preserved because those paths aren't in the deferred tree. Sync paths (direct function calls during render) are also unaffected and retain fully unconditional cache keys.

Test plan

• 10 new bug fixture tests covering: nullable prop + onClick, TS non-null assertion, mixed optional chains, nested properties, useEffectEvent pattern, hook arguments, assertion functions, multiple closures, conditional render access, returned functions
• 2 correctness guard fixtures confirming sync paths (direct calls, render-time accesses) are preserved
• All 1730 existing compiler tests pass
• 38 existing snapshot updates reviewed — all show safe cache key changes for deferred paths (e.g. obj to obj?.value)
• direct-call and conditional-call fixtures unchanged (sync paths preserved)
• try-catch-maybe-null-dependency, jump-poisoned/*, and merge-uncond-optional-chain-and-cond fixtures unchanged (render-time truncation preserved)

[msrinika1-byte]

AI Code Review Report

Generated at 3/21/2026, 12:25:26 AM

Summary

Metric	Value
Score	100/100
Risk Level	✅ LOW
Total Issues	0
Files Reviewed	0

No issues found across 57 file(s). Great work!

██████████ 100/100

✅ No Issues Found

All reviewed files passed the AI review checks.

[msrinika1-byte]

AI Code Review Report

Generated at 3/21/2026, 12:27:18 AM

Summary

Metric	Value
Score	100/100
Risk Level	✅ LOW
Total Issues	0
Files Reviewed	0

No issues found across 57 file(s). Great work!

██████████ 100/100

✅ No Issues Found

All reviewed files passed the AI review checks.