assert,util: stricter type comparison using deep equal comparisons

This veryfies that both input arguments are always of the identical
type. It was possible to miss a few cases before. This change applies
to all deep equal assert functions (e.g., `assert.deepStrictEqual()`)
and to `util.isDeepStrictEqual()`.
PR-URL: #30764
Refs: #30743
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: David Carlier <devnexen@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

Author: BridgeAR

lib/internal/util/comparisons.js

@@ -19,9 +19,11 @@ const {
  Set,
  StringPrototypeValueOf,
  SymbolPrototypeValueOf,
+ SymbolToStringTag,
 }=primordials;
 
 const{ compare }=internalBinding('buffer');
+consttypes=require('internal/util/types');
 const{
  isAnyArrayBuffer,
  isArrayBufferView,
@@ -37,8 +39,17 @@ const {
  isBigIntObject,
  isSymbolObject,
  isFloat32Array,
- isFloat64Array
-}=require('internal/util/types');
+ isFloat64Array,
+ isUint8Array,
+ isUint8ClampedArray,
+ isUint16Array,
+ isUint32Array,
+ isInt8Array,
+ isInt16Array,
+ isInt32Array,
+ isBigInt64Array,
+ isBigUint64Array
+}=types;
 const{
  getOwnNonIndexProperties,
 propertyFilter: {
@@ -110,6 +121,33 @@ function isEqualBoxedPrimitive(val1, val2) {
 returnfalse;
 }
 
+functionisIdenticalTypedArrayType(a,b){
+// Fast path to reduce type checks in the common case.
+constcheck=types[`is${a[SymbolToStringTag]}`];
+if(check!==undefined&&check(a)){
+returncheck(b);
+}
+// Manipulated Symbol.toStringTag.
+for(constcheckof[
+isUint16Array,
+isUint32Array,
+isInt8Array,
+isInt16Array,
+isInt32Array,
+isFloat32Array,
+isFloat64Array,
+isBigInt64Array,
+isBigUint64Array,
+isUint8ClampedArray,
+isUint8Array
+]){
+if(check(a)){
+returncheck(b);
+}
+}
+returnfalse;
+}
+
 // Notes: Type tags are historical [[Class]] properties that can be set by
 // FunctionTemplate::SetClassName() in C++ or Symbol.toStringTag in JS
 // and retrieved using Object.prototype.toString.call(obj) in JS
@@ -118,15 +156,8 @@ function isEqualBoxedPrimitive(val1, val2) {
 // There are some unspecified tags in the wild too (e.g. typed array tags).
 // Since tags can be altered, they only serve fast failures
 //
-// Typed arrays and buffers are checked by comparing the content in their
-// underlying ArrayBuffer. This optimization requires that it's
-// reasonable to interpret their underlying memory in the same way,
-// which is checked by comparing their type tags.
-// (e.g. a Uint8Array and a Uint16Array with the same memory content
-// could still be different because they will be interpreted differently).
-//
 // For strict comparison, objects should have
-// a) The same built-in type tags
+// a) The same built-in type tag.
 // b) The same prototypes.
 
 functioninnerDeepEqual(val1,val2,strict,memos){
@@ -167,9 +198,10 @@ function innerDeepEqual(val1, val2, strict, memos) {
 if(val1Tag!==val2Tag){
 returnfalse;
 }
+
 if(ArrayIsArray(val1)){
 // Check for sparse arrays and general fast path
-if(val1.length!==val2.length){
+if(!ArrayIsArray(val2)||val1.length!==val2.length){
 returnfalse;
 }
 constfilter=strict ? ONLY_ENUMERABLE : ONLY_ENUMERABLE|SKIP_SYMBOLS;
@@ -179,25 +211,28 @@ function innerDeepEqual(val1, val2, strict, memos) {
 returnfalse;
 }
 returnkeyCheck(val1,val2,strict,memos,kIsArray,keys1);
-}
-if(val1Tag==='[object Object]'){
+}elseif(val1Tag==='[object Object]'){
 returnkeyCheck(val1,val2,strict,memos,kNoIterator);
-}
-if(isDate(val1)){
-if(DatePrototypeGetTime(val1)!==DatePrototypeGetTime(val2)){
+}elseif(isDate(val1)){
+if(!isDate(val2)||
+DatePrototypeGetTime(val1)!==DatePrototypeGetTime(val2)){
 returnfalse;
 }
 }elseif(isRegExp(val1)){
-if(!areSimilarRegExps(val1,val2)){
+if(!isRegExp(val2)||!areSimilarRegExps(val1,val2)){
 returnfalse;
 }
 }elseif(isNativeError(val1)||val1instanceofError){
 // Do not compare the stack as it might differ even though the error itself
 // is otherwise identical.
-if(val1.message!==val2.message||val1.name!==val2.name){
+if((!isNativeError(val2)&&!(val2instanceofError))||
+val1.message!==val2.message||
+val1.name!==val2.name){
 returnfalse;
 }
 }elseif(isArrayBufferView(val1)){
+if(!isIdenticalTypedArrayType(val1,val2))
+returnfalse;
 if(!strict&&(isFloat32Array(val1)||isFloat64Array(val1))){
 if(!areSimilarFloatArrays(val1,val2)){
 returnfalse;
@@ -226,12 +261,23 @@ function innerDeepEqual(val1, val2, strict, memos) {
 }
 returnkeyCheck(val1,val2,strict,memos,kIsMap);
 }elseif(isAnyArrayBuffer(val1)){
-if(!areEqualArrayBuffers(val1,val2)){
+if(!isAnyArrayBuffer(val2)||!areEqualArrayBuffers(val1,val2)){
 returnfalse;
 }
-}
-if((isBoxedPrimitive(val1)||isBoxedPrimitive(val2))&&
-!isEqualBoxedPrimitive(val1,val2)){
+}elseif(isBoxedPrimitive(val1)){
+if(!isEqualBoxedPrimitive(val1,val2)){
+returnfalse;
+}
+}elseif(ArrayIsArray(val2)||
+isArrayBufferView(val2)||
+isSet(val2)||
+isMap(val2)||
+isDate(val2)||
+isRegExp(val2)||
+isAnyArrayBuffer(val2)||
+isBoxedPrimitive(val2)||
+isNativeError(val2)||
+val2instanceofError){
 returnfalse;
 }
 returnkeyCheck(val1,val2,strict,memos,kNoIterator);

test/parallel/test-assert-deep.js

@@ -1138,3 +1138,69 @@ assert.throws(
 // The descriptor is not compared.
 assertDeepAndStrictEqual(a,{a: 5});
 }
+
+// Verify object types being identical on both sides.
+{
+leta=Buffer.from('test');
+letb=Object.create(
+Object.getPrototypeOf(a),
+Object.getOwnPropertyDescriptors(a)
+);
+Object.defineProperty(b,Symbol.toStringTag,{
+value: 'Uint8Array'
+});
+assertNotDeepOrStrict(a,b);
+
+a=newUint8Array(10);
+b=newInt8Array(10);
+Object.defineProperty(b,Symbol.toStringTag,{
+value: 'Uint8Array'
+});
+Object.setPrototypeOf(b,Uint8Array.prototype);
+assertNotDeepOrStrict(a,b);
+
+a=[1,2,3];
+b={0: 1,1: 2,2: 3};
+Object.setPrototypeOf(b,Array.prototype);
+Object.defineProperty(b,'length',{value: 3,enumerable: false});
+Object.defineProperty(b,Symbol.toStringTag,{
+value: 'Array'
+});
+assertNotDeepOrStrict(a,b);
+
+a=newDate(2000);
+b=Object.create(
+Object.getPrototypeOf(a),
+Object.getOwnPropertyDescriptors(a)
+);
+Object.defineProperty(b,Symbol.toStringTag,{
+value: 'Date'
+});
+assertNotDeepOrStrict(a,b);
+
+a=/abc/g;
+b=Object.create(
+Object.getPrototypeOf(a),
+Object.getOwnPropertyDescriptors(a)
+);
+Object.defineProperty(b,Symbol.toStringTag,{
+value: 'RegExp'
+});
+assertNotDeepOrStrict(a,b);
+
+a=[];
+b=/abc/;
+Object.setPrototypeOf(b,Array.prototype);
+Object.defineProperty(b,Symbol.toStringTag,{
+value: 'Array'
+});
+assertNotDeepOrStrict(a,b);
+
+a=Object.create(null);
+b=newRangeError('abc');
+Object.defineProperty(a,Symbol.toStringTag,{
+value: 'Error'
+});
+Object.setPrototypeOf(b,null);
+assertNotDeepOrStrict(a,b,assert.AssertionError);
+}