fix(minifier): keep unary + when the other operand has side effects

[mizchi]

substitute_unary_plus removes a + when the enclosing binary operator will do the ToNumber conversion anyway. The existing doc comment reasons carefully about ToNumber vs ToNumeric, but not about when each runs.

+a converts a while evaluating +a, before the right operand is evaluated at all. a - n converts it in ApplyStringOrNumericBinaryOperator, after n has been evaluated. Dropping the + therefore moves the conversion across n, and a right operand with a side effect can change what the conversion sees:

var xs = [];
console.log((+xs) - (xs.push(1), 0)); // 0, converted while `xs` was still empty

// oxc emitted:
console.log(xs - (xs.push(1), 0));    // 1, converted after `xs` grew

This PR requires the right operand to be free of side effects before dropping a + in the left position. It cannot observe the conversion either: under the "Coercion Methods Are Pure" assumption the conversion runs no user code, so there is nothing to observe.

The right position (n - +a) is left as is: n is evaluated first either way, and its ToNumeric is a no-op because the existing guard already established that n is a number, so nothing runs between evaluating a and converting it.

cargo minsize moves the typescript.js gzip figure down by 10 bytes; every minified size is identical.

The reproduction was found by the minifier fuzzer (#25594) at seed 12397.

Differential testing

Every case below was run through oxc and then executed in Node against the unminified source, comparing the result, the mutated state, and the error constructor and message.

shape	cases	value worlds	runs
operator × 37 hand-written right operands	814	41	33,374
right operand reading a closure variable the conversion may write	374	41	15,334
argument shape (+a.v, +f(), +(seq(), a), +(+a), getter) × nesting	3,168	41	129,888
random expressions, 3 seeds, depth 2-3	7,500	41	307,500

The worlds cover [], { valueOf: () => 10n }, Symbol(), Object.create(null), objects with getters, Proxy, and the numeric edge cases.

No difference survives, other than one that predates this pass and is discussed in the doc comment: for a BigInt argument both forms throw a TypeError, but +a says "Cannot convert a BigInt value to a number" while a - 1 says "Cannot mix BigInt and other types". The error kind never changes.

---

Written with AI assistance (Claude Code). Reviewed by me, and the before/after behaviour was checked against Node.js.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 77603e4e86

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[codspeed-hq]

Merging this PR will not alter performance

✅ 39 untouched benchmarks
⏩ 42 skipped benchmarks¹

---

_{Comparing mizchi:fix/unary-plus-coercion-order (ae237e8) with main (af82a07)²}

Footnotes

1. 42 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on main (8e2b3be) during the generation of this report, so af82a07 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩