[Low][core] debounce({leading,trailing}) double-invokes on a single call #178

Severity: 🟢 Low (correctness)

Location

src/core/utils/function.ts:99-118 (debounce).

Description

With { leading: true, trailing: true }, a single call double-invokes: the leading branch invokes immediately with preservePending = trailing (keeping pendingArgs), then trailingTrigger fires and, seeing pendingArgs still set, invokes again. So one call yields two invocations. Lodash semantics fire the trailing edge only when the function was called more than once during the wait window.

Reproduction

const fn = debounce(spy, 50, { leading: true, trailing: true });
fn('a');                 // leading fires immediately
// after 50ms: trailing fires again with 'a'  → spy called twice for one call

Suggested fix

Track whether a subsequent call occurred after the leading invoke; only run the trailing edge if so (clear pendingArgs after a leading-only single call).

Filed as part of a full-codebase security & correctness audit.