Skip to content

Add reproduction for Equal issue - #6874

Merged
tim-smart merged 4 commits into
mainfrom
audit/repro-core-equal-never-throws
Aug 2, 2026
Merged

Add reproduction for Equal issue#6874
tim-smart merged 4 commits into
mainfrom
audit/repro-core-equal-never-throws

Conversation

@fubhy

@fubhy fubhy commented Aug 1, 2026

Copy link
Copy Markdown
Member

Fix

This PR adds reproduction tests and fixes the underlying Equal.equals and Hash.hash handling for invalid dates and DataView values.

Covered audit issues

1. core-a-f-equal-dataview-throws: DataView comparison throws instead of comparing bytes

Module: Equal

Expected contract: Equal.equals deeply compares supported objects and never throws; ArrayBuffer views enter the typed-array comparison path.

Observed result: A direct Node 24 source probe reproduced RangeError for invalid dates and TypeError for DataViews.

Reproduction command:

pnpm test --run packages/effect/test/Equal.test.ts

2. core-a-f-equal-invalid-date-throws: Invalid dates violate Equal.equals never-throws contract

Module: Equal

Expected contract: Equal.equals returns a boolean and never throws, including for JavaScript Date values.

Observed result: A direct Node 24 source probe reproduced RangeError for invalid dates and TypeError for DataViews.

Reproduction command:

pnpm test --run packages/effect/test/Equal.test.ts

Closes EFF-310

@github-project-automation github-project-automation Bot moved this to Discussion Ongoing in PR Backlog Aug 1, 2026
@changeset-bot

changeset-bot Bot commented Aug 1, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: c6ccd50

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 30 packages
Name Type
effect Patch
@effect/opentelemetry Patch
@effect/platform-browser Patch
@effect/platform-bun Patch
@effect/platform-deno Patch
@effect/platform-node-shared Patch
@effect/platform-node Patch
@effect/vitest Patch
@effect/ai-anthropic Patch
@effect/ai-openai-compat Patch
@effect/ai-openai Patch
@effect/ai-openrouter Patch
@effect/atom-react Patch
@effect/atom-solid Patch
@effect/atom-vue Patch
@effect/sql-clickhouse Patch
@effect/sql-d1 Patch
@effect/sql-libsql Patch
@effect/sql-mssql Patch
@effect/sql-mysql2 Patch
@effect/sql-pg Patch
@effect/sql-pglite Patch
@effect/sql-sqlite-bun Patch
@effect/sql-sqlite-do Patch
@effect/sql-sqlite-node Patch
@effect/sql-sqlite-react-native Patch
@effect/sql-sqlite-wasm Patch
@effect/docgen Patch
@effect/doctest Patch
@effect/openapi-generator Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@effect-slopcop effect-slopcop Bot added the 4.0 label Aug 1, 2026

@pullfrog pullfrog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ No new issues found.

Reviewed changes

  • EqualNeverThrows.test.ts: Adds two reproduction tests confirming Equal.equals throws for invalid Date values (RangeError from toISOString() in Hash.hash) and for DataView values (TypeError from iterating a non-iterable in the array() hash path).

Pullfrog  | View workflow run | Using DeepSeek Pro (free via Pullfrog for OSS) (Kimi K2 not used — the program covers this model; add its provider key to run your pick) | 𝕏

@effect-slopcop effect-slopcop Bot added 3.0 Used for issues, pull requests, etc. that are relevant for the `v3` branch targeting Effect v3. bug Something isn't working 4.0 and removed 4.0 3.0 Used for issues, pull requests, etc. that are relevant for the `v3` branch targeting Effect v3. labels Aug 2, 2026
@@ -0,0 +1,15 @@
import { assert, describe, it } from "@effect/vitest"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove this test file and merge with the main one.

@pullfrog pullfrog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ No new issues found.

Reviewed changes

  • Date comparison: Switched from toISOString() to getTime() with a NaN guard, so invalid dates no longer throw.
  • DataView comparison: Added a compareDataViews helper that wraps the DataView buffer in Uint8Array before delegating to compareTypedArrays, with a DataView instance-of check to reject mixed-type pairs.
  • Hash module: Guarded Date.prototype.toISOString() against NaN and added a DataView-specific branch that wraps the buffer in Uint8Array before calling array().
  • Tests: Consolidated reproduction tests into Equal.test.ts, covering invalid-date equality and DataView byte comparison.

Pullfrog  | View workflow run | Using DeepSeek Pro (free via Pullfrog for OSS) (Kimi K2 not used — the program covers this model; add its provider key to run your pick) | 𝕏

Comment thread packages/effect/src/Equal.ts Outdated
return true
}

function compareDataViews(self: DataView, that: DataView): boolean {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Considering this helper is only used in one place in-line it please.

@tim-smart
tim-smart enabled auto-merge (squash) August 2, 2026 23:14
@tim-smart
tim-smart merged commit b3901d2 into main Aug 2, 2026
18 checks passed
@tim-smart
tim-smart deleted the audit/repro-core-equal-never-throws branch August 2, 2026 23:44
@github-project-automation github-project-automation Bot moved this from Discussion Ongoing to Done in PR Backlog Aug 2, 2026
@github-actions

github-actions Bot commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Bundle Size Analysis

Generated from PR build output; treat the content below as untrusted.

File Name Current Size Previous Size Difference
basic.ts 6.77 KB 6.65 KB +0.13 KB (+1.90%)
batching.ts 9.57 KB 9.44 KB +0.13 KB (+1.40%)
brand.ts 6.45 KB 6.33 KB +0.12 KB (+1.91%)
cache.ts 10.31 KB 10.20 KB +0.11 KB (+1.12%)
config.ts 20.47 KB 20.34 KB +0.12 KB (+0.60%)
differ.ts 20.08 KB 19.95 KB +0.13 KB (+0.64%)
http-client.ts 21.15 KB 21.04 KB +0.11 KB (+0.53%)
logger.ts 10.46 KB 10.35 KB +0.12 KB (+1.12%)
metric.ts 8.70 KB 8.58 KB +0.13 KB (+1.46%)
optic.ts 7.46 KB 7.34 KB +0.12 KB (+1.62%)
pubsub.ts 14.60 KB 14.49 KB +0.12 KB (+0.81%)
queue.ts 11.26 KB 11.15 KB +0.11 KB (+1.00%)
schedule.ts 10.44 KB 10.33 KB +0.11 KB (+1.06%)
schema-class.ts 19.01 KB 18.88 KB +0.13 KB (+0.69%)
schema-fromJsonSchemaDocument.ts 28.81 KB 28.69 KB +0.12 KB (+0.42%)
schema-representation-roundtrip.ts 25.14 KB 25.01 KB +0.13 KB (+0.52%)
schema-string-transformation.ts 13.12 KB 13.01 KB +0.11 KB (+0.85%)
schema-string.ts 10.79 KB 10.66 KB +0.12 KB (+1.13%)
schema-template-literal.ts 14.99 KB 14.87 KB +0.13 KB (+0.85%)
schema-toArbitraryLazy.ts 21.80 KB 21.67 KB +0.12 KB (+0.57%)
schema-toCodeDocument.ts 24.20 KB 24.10 KB +0.11 KB (+0.44%)
schema-toCodecJson.ts 19.05 KB 18.93 KB +0.12 KB (+0.63%)
schema-toEquivalence.ts 18.88 KB 18.74 KB +0.14 KB (+0.73%)
schema-toFormatter.ts 18.74 KB 18.61 KB +0.13 KB (+0.70%)
schema-toJsonSchemaDocument.ts 22.49 KB 22.36 KB +0.14 KB (+0.61%)
schema-toRepresentation.ts 19.41 KB 19.28 KB +0.13 KB (+0.67%)
schema.ts 18.26 KB 18.14 KB +0.13 KB (+0.69%)
stm.ts 12.25 KB 12.13 KB +0.12 KB (+0.96%)
stream.ts 9.49 KB 9.38 KB +0.11 KB (+1.18%)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

4.0 bug Something isn't working

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

2 participants