Summary

Partially addresses #37761. This fixes repros 2, 3 and 4 there (forward and self-referencing closures). Repro 1 (.map()) has a different cause, described below.

InferMutationAliasingRanges treats mutating a function value as calling it. When mutate() reaches a Function node it records the function's errors (Impure, MutateFrozen, MutateGlobal). However, the traversal also reaches function nodes by forward edges (Capture x -> fn). That only means a value the function captured was mutated; the function itself was not called.

This happens with hoisted context variables. StoreContext later = ... emits Mutate later, and the mutation flows forward into every closure that captured later. Those closures are then reported even if they only ever run from an event handler or timer:

const arm = () => {
  setState(String(Date.now())); // reported: "Cannot call impure function during render"
  later();
};
const later = () => setState('done');
return <button onClick={arm} />;

Self-referencing closures (const tick = () => { Date.now(); setTimeout(tick) }) hit the same path.

Changes

• mutate() only appends function errors when the node is reached by backward traversal: the call target itself, or something it aliases or captures.
• Previously node.transitive == null && node.local == null doubled as the "report once" guard. A forward visit now marks the node as mutated without reporting it. Without a fix, that would suppress the report on a later real call, e.g. const fact = k => ... fact(k - 1) ...; fact(n) during render, which goes LoadContext → CreateFrom → captured function. So reported functions are now tracked in their own set. render() uses the same set.
• The same change is mirrored in react_compiler_inference/src/infer_mutation_aliasing_ranges.rs.

Not addressed: repro 1 from #37761

With items.map(item => <button onClick={() => open(item)} />), the receiver type is unknown, so the call is modelled as MutateTransitiveConditionally on the callback. The transitive walk then follows the callback's capture of open backwards. That is the same path that correctly reports items.map(item => open(item)). Telling the two apart needs the callback's own aliasing signature, which is a bigger design question, so I left it out of this PR.

How did you test this change?

New fixtures:

• impure-call-in-handler-calling-later-declared-function: issue repro 2. Previously errored, now compiles.
• impure-call-in-later-declared-function-called-from-handler: issue repro 3. Previously errored, now compiles.
• impure-call-in-self-referencing-function: issue repro 4. Previously errored, now compiles.
• error.invalid-impure-call-via-later-declared-function-in-render: calling through a later-declared function during render is still reported.
• error.invalid-impure-call-in-self-referencing-function-in-render: a self-referencing function called during render is still reported. An earlier version of this change, without the separate reported set, failed this fixture.

Checks run in compiler/:

• yarn snap: 1832/1832 passed (no existing fixture output changed).
• yarn snap --rust: 1832/1832 passed.
• bash scripts/test-rust-port.sh: 1831/1831 passed.
• bash scripts/test-babel-ast.sh: ok.
• yarn workspace babel-plugin-react-compiler lint: passes. cargo fmt --check: clean. Prettier (repo options): clean.