Skip to content

[Fix] avoid relying on indexOf's HasProperty+Get semantics, unlike includes's bare Get - #54

Open
rajanpanth wants to merge 1 commit into
es-shims:mainfrom
rajanpanth:fix/proxy-has-trap-divergence
Open

[Fix] avoid relying on indexOf's HasProperty+Get semantics, unlike includes's bare Get#54
rajanpanth wants to merge 1 commit into
es-shims:mainfrom
rajanpanth:fix/proxy-has-trap-divergence

Conversation

@rajanpanth

Copy link
Copy Markdown

Summary

The fast path delegates to $indexOf.apply(this, arguments) whenever searchElement isn't NaN/undefined and fromIndex is finite. For ordinary arrays this matches the spec's own includes algorithm, but indexOf's per-index step is HasProperty, then Get only if present, while includes's is a bare Get — per spec (Array.prototype.includes explicitly notes it "does not skip missing array elements, instead treating them as undefined", unlike indexOf).

For an exotic object whose has trap disagrees with its get trap, that difference is observable:

var target = [1, 2, 3, 4, 5];
var proxy = new Proxy(target, {
  has: function () { return false; },
  get: function (t, k, r) { return Reflect.get(t, k, r); }
});

Array.prototype.includes.call(proxy, 3); // true  (native, spec-correct)
includes.call(proxy, 3);                 // false (this shim, via the indexOf shortcut)

Changes

  • implementation.js: removed the indexOf-based fast path (and its now-unused $isNaN/$isFinite/$indexOf requires). The existing manual loop already implements the correct includes algorithm (bare Get via O[k], SameValueZero) and was only being skipped by this shortcut — so removing it is enough, no new logic needed.
  • test/tests.js: one new case (guarded by typeof Proxy === 'function', matching the pattern in is-callable's own tests) confirming a lying has trap doesn't hide an element that's still reachable via get.

Testing

  • Full suite: 117/117 passing (up from 114 — the new case runs against all three entry points, though only the direct implementation.js path is actually exercised by the bug, since index.js/shimmed.js prefer the native method when available).
  • Confirmed the new test fails on the prior code and passes with the fix.
  • eslint reports the same pre-existing linebreak-style/no-magic-numbers findings with and without this change (Windows checkout CRLF artifact + pre-existing style, unrelated) — no new lint issues, and one magic-number warning (-1) actually goes away since that line is removed.

…ike `includes`'s bare `Get`

The fast path delegated to $indexOf.apply(this, arguments) whenever
searchElement wasn't NaN/undefined and fromIndex was finite. For
ordinary arrays this is equivalent to the spec's own includes
algorithm, but indexOf's per-index step is "HasProperty, then Get
only if present" while includes's is a bare Get -- so for an exotic
object whose has trap disagrees with its get trap (e.g. a Proxy),
delegating to indexOf can silently miss an element that includes
must find.

Removed the optimization; the existing manual loop already
implements the correct includes algorithm (bare Get, SameValueZero)
and was only being skipped by this shortcut.
@codecov

codecov Bot commented Aug 8, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.00%. Comparing base (2b23666) to head (c7d26a3).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main      #54      +/-   ##
==========================================
+ Coverage   94.54%   98.00%   +3.45%     
==========================================
  Files           5        5              
  Lines          55       50       -5     
  Branches        8        7       -1     
==========================================
- Hits           52       49       -3     
+ Misses          3        1       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant