Commit 248ff9f
assert,util: fix TypeError on Maps with null keys
`assert.deepStrictEqual`, `assert.notDeepStrictEqual`, and
`util.isDeepStrictEqual` threw a `TypeError` instead of returning a
result when one Map had a `null` key with an object value, the other
had an object key with a deeply-equal value but no `null` key, and
both maps were the same size.
In that case `mapObjectEquiv` skipped its primitive and `null` key
handling, which was gated on `array.length !== a.size`, and passed
the `null` key (which is `typeof 'object'`) to the object comparator.
That comparator reads `key.constructor` without a null guard, so it
threw. Handle primitive and `null` keys unconditionally, resolving
them directly against the other map.
Fixes: #64433
Signed-off-by: Paul Bouchon <mail@bitpshr.net>
PR-URL: #64441
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>1 parent 4d48984 commit 248ff9f
2 files changed
Lines changed: 16 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -837,10 +837,13 @@ function mapObjectEquiv(array, a, b, mode, memo) { | |||
| 837 | 837 | let start = 0; | |
| 838 | 838 | let end = array.length - 1; | |
| 839 | 839 | const comparator = mode !== kLoose ? objectComparisonStart : innerDeepEqual; | |
| 840 | - const extraChecks = mode === kLoose || array.length !== a.size; | ||
| 841 | 840 | ||
| 842 | 841 | for (const { 0: key1, 1: item1 } of a) { | |
| 843 | - if (extraChecks && (typeof key1 !== 'object' || key1 === null)) { | ||
| 842 | + // Primitive and `null` keys can never match an object key collected in | ||
| 843 | + // `array`, so resolve them directly against `b`. `null` is `typeof | ||
| 844 | + // 'object'`, so without this it would reach the object comparator, which | ||
| 845 | + // reads `key1.constructor` and throws a `TypeError`. | ||
| 846 | + if (typeof key1 !== 'object' || key1 === null) { | ||
| 844 | 847 | if (b.has(key1)) { | |
| 845 | 848 | if (mode !== kLoose || innerDeepEqual(item1, b.get(key1), mode, memo)) { | |
| 846 | 849 | continue; | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -421,6 +421,17 @@ test('es6 Maps and Sets', () => { | |||
| 421 | 421 | new Map([[undefined, null], ['+000', 2n]]), | |
| 422 | 422 | new Map([[null, undefined], [false, '2']]), | |
| 423 | 423 | ); | |
| 424 | + // A null key whose value is an object, alongside another object key and a | ||
| 425 | + // matching map size, must not crash the unordered object-key matching (null | ||
| 426 | + // is `typeof 'object'`). Refs: https://github.com/nodejs/node/issues/64433 | ||
| 427 | + assertNotDeepOrStrict( | ||
| 428 | + new Map([[null, { v: 1 }], [{ a: 1 }, 1]]), | ||
| 429 | + new Map([[{ b: 2 }, { v: 1 }], [{ a: 1 }, 1]]) | ||
| 430 | + ); | ||
| 431 | + assertDeepAndStrictEqual( | ||
| 432 | + new Map([[null, { v: 1 }], [{ a: 1 }, 1]]), | ||
| 433 | + new Map([[null, { v: 1 }], [{ a: 1 }, 1]]) | ||
| 434 | + ); | ||
| 424 | 435 | const xarray = ['x']; | |
| 425 | 436 | assertDeepAndStrictEqual( | |
| 426 | 437 | new Set([xarray, ['y']]), | |
0 commit comments