Merge pull request #22844 from ku-plrg/js/array-flatmap-thisarg

JS: Fix flatMap thisArg flowing to the callback index

Author: asgerf

javascript/ql/lib/change-notes/2026-10-19-array-flatmap-thisarg.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed the flow summary for `Array.prototype.flatMap`. The `thisArg` argument now flows to the callback's `this` instead of its index parameter.

javascript/ql/lib/semmle/javascript/internal/flow_summaries/Arrays.qll

@@ -290,7 +290,7 @@ class FlatMap extends SummarizedCallable::Range {
       output = "Argument[0].Parameter[2]"
       or
       input = "Argument[1]" and
-      output = "Argument[0].Parameter[1]"
+      output = "Argument[0].Parameter[this]"
       or
       input = "Argument[0].ReturnValue." + ["ArrayElement", "WithoutArrayElement"] and
       output = "ReturnValue.ArrayElement"

javascript/ql/test/library-tests/TripleDot/array-flatmap.js

@@ -0,0 +1,7 @@
+function flatMapThisArg() {
+    [0].flatMap(function (x, i) {
+        sink(this); // $ hasValueFlow=flatMap.thisArg
+        sink(i); // OK - the index, not thisArg
+        return [];
+    }, source('flatMap.thisArg'));
+}