vfs: reject rename into descendant directory

MemoryProvider allowed renaming a directory into its own descendant,
which detached the subtree from the root. Reject this case with EINVAL
before mutating the tree.
Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
PR-URL: #64285Fixes: #64284
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Author: trivikr

lib/internal/vfs/providers/memory.js

@@ -7,6 +7,7 @@ const {
  SafeMap,
  SafeSet,
  StringPrototypeReplaceAll,
+ StringPrototypeStartsWith,
  Symbol,
 }=primordials;
 
@@ -794,6 +795,11 @@ class MemoryProvider extends VirtualProvider {
 // Get the entry (without following symlinks for the entry itself)
 constentry=this.#getEntry(normalizedOld,'rename',false);
 
+if(entry.isDirectory()&&
+StringPrototypeStartsWith(normalizedNew,`${normalizedOld}/`)){
+throwcreateEINVAL('rename',oldPath);
+}
+
 // Validate destination parent exists (do not auto-create)
 constnewParent=this.#ensureParent(normalizedNew,false,'rename');
 constnewName=pathPosix.basename(normalizedNew);

test/parallel/test-vfs-rename.js

@@ -44,3 +44,17 @@ const vfs = require('node:vfs');
 assert.strictEqual(myVfs.existsSync('/d/a.txt'),false);
 assert.strictEqual(myVfs.existsSync('/d/b.txt'),true);
 }
+
+// Renaming a directory into its own descendant throws EINVAL
+{
+constmyVfs=vfs.create();
+myVfs.mkdirSync('/a/b',{recursive: true});
+myVfs.writeFileSync('/a/file.txt','data');
+
+assert.throws(()=>myVfs.renameSync('/a','/a/b/c'),{code: 'EINVAL'});
+assert.deepStrictEqual(myVfs.readdirSync('/'),['a']);
+assert.strictEqual(myVfs.existsSync('/a'),true);
+assert.strictEqual(myVfs.existsSync('/a/b'),true);
+assert.strictEqual(myVfs.existsSync('/a/b/c'),false);
+assert.strictEqual(myVfs.readFileSync('/a/file.txt','utf8'),'data');
+}