assert,util: fix constructor lookup in deep equal comparison

The latest performance optimization did not take into account that
an object may have a property called constructor. This is addressed
in this PR by adding a new fast path and using fallbacks.

PR-URL: #57876
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Author: BridgeAR

benchmark/assert/deepequal-prims-and-objs-big-loop.js

@@ -10,6 +10,7 @@ const notCircular = {};
 notCircular.circular = {};
 
 const primValues = {
+  'null_prototype': { __proto__: null },
   'string': 'abcdef',
   'number': 1_000,
   'boolean': true,
@@ -24,6 +25,7 @@ const primValues = {
 };
 
 const primValues2 = {
+  'null_prototype': { __proto__: null },
   'object': { property: 'abcdef' },
   'array': [1, 2, 3],
   'set_object': new Set([[1]]),
@@ -35,6 +37,7 @@ const primValues2 = {
 };
 
 const primValuesUnequal = {
+  'null_prototype': { __proto__: { __proto__: null } },
   'string': 'abcdez',
   'number': 1_001,
   'boolean': false,

lib/internal/util/comparisons.js

@@ -1,14 +1,31 @@
 'use strict';
 
 const {
+  Array,
+  ArrayBuffer,
   ArrayIsArray,
   ArrayPrototypeFilter,
   ArrayPrototypePush,
+  BigInt,
+  BigInt64Array,
   BigIntPrototypeValueOf,
+  BigUint64Array,
+  Boolean,
   BooleanPrototypeValueOf,
+  DataView,
+  Date,
   DatePrototypeGetTime,
   Error,
+  Float32Array,
+  Float64Array,
+  Function,
+  Int16Array,
+  Int32Array,
+  Int8Array,
+  Map,
+  Number,
   NumberPrototypeValueOf,
+  Object,
   ObjectGetOwnPropertyDescriptor,
   ObjectGetOwnPropertySymbols: getOwnSymbols,
   ObjectGetPrototypeOf,
@@ -17,18 +34,67 @@ const {
   ObjectPrototypeHasOwnProperty: hasOwn,
   ObjectPrototypePropertyIsEnumerable: hasEnumerable,
   ObjectPrototypeToString,
+  Promise,
+  RegExp,
   SafeSet,
+  Set,
+  String,
   StringPrototypeValueOf,
+  Symbol,
   SymbolPrototypeValueOf,
   TypedArrayPrototypeGetByteLength: getByteLength,
   TypedArrayPrototypeGetSymbolToStringTag,
+  Uint16Array,
+  Uint32Array,
   Uint8Array,
+  Uint8ClampedArray,
+  WeakMap,
+  WeakSet,
+  globalThis: { Float16Array },
 } = primordials;
 
 const { compare } = internalBinding('buffer');
 const assert = require('internal/assert');
 const { isError } = require('internal/util');
 const { isURL } = require('internal/url');
+const { Buffer } = require('buffer');
+
+const wellKnownConstructors = new SafeSet()
+  .add(Array)
+  .add(ArrayBuffer)
+  .add(BigInt)
+  .add(BigInt64Array)
+  .add(BigUint64Array)
+  .add(Boolean)
+  .add(Buffer)
+  .add(DataView)
+  .add(Date)
+  .add(Error)
+  .add(Float32Array)
+  .add(Float64Array)
+  .add(Function)
+  .add(Int16Array)
+  .add(Int32Array)
+  .add(Int8Array)
+  .add(Map)
+  .add(Number)
+  .add(Object)
+  .add(Promise)
+  .add(RegExp)
+  .add(Set)
+  .add(String)
+  .add(Symbol)
+  .add(Uint16Array)
+  .add(Uint32Array)
+  .add(Uint8Array)
+  .add(Uint8ClampedArray)
+  .add(WeakMap)
+  .add(WeakSet);
+
+if (Float16Array) { // TODO(BridgeAR): Remove when regularly supported
+  wellKnownConstructors.add(Float16Array);
+}
+
 const types = require('internal/util/types');
 const {
   isAnyArrayBuffer,
@@ -199,11 +265,15 @@ function innerDeepEqual(val1, val2, mode, memos) {
 }
 
 function objectComparisonStart(val1, val2, mode, memos) {
-  if (mode === kStrict &&
-      (val1.constructor !== val2.constructor ||
-        (val1.constructor === undefined &&
-          ObjectGetPrototypeOf(val1) !== ObjectGetPrototypeOf(val2)))) {
-    return false;
+  if (mode === kStrict) {
+    if (wellKnownConstructors.has(val1.constructor) ||
+        (val1.constructor !== undefined && !hasOwn(val1, 'constructor'))) {
+      if (val1.constructor !== val2.constructor) {
+        return false;
+      }
+    } else if (ObjectGetPrototypeOf(val1) !== ObjectGetPrototypeOf(val2)) {
+      return false;
+    }
   }
 
   const val1Tag = ObjectPrototypeToString(val1);

lib/internal/util/inspect.js

@@ -20,10 +20,18 @@ const {
   ArrayPrototypeSplice,
   ArrayPrototypeUnshift,
   BigIntPrototypeValueOf,
+  Boolean,
+  BooleanPrototype,
   BooleanPrototypeValueOf,
+  DataView,
+  DataViewPrototype,
+  Date,
+  DatePrototype,
   DatePrototypeGetTime,
   DatePrototypeToISOString,
   DatePrototypeToString,
+  Error,
+  ErrorPrototype,
   ErrorPrototypeToString,
   Function,
   FunctionPrototype,
@@ -47,6 +55,7 @@ const {
   NumberIsNaN,
   NumberParseFloat,
   NumberParseInt,
+  NumberPrototype,
   NumberPrototypeToString,
   NumberPrototypeValueOf,
   Object,
@@ -63,9 +72,12 @@ const {
   ObjectPrototypePropertyIsEnumerable,
   ObjectSeal,
   ObjectSetPrototypeOf,
+  Promise,
+  PromisePrototype,
   ReflectApply,
   ReflectOwnKeys,
   RegExp,
+  RegExpPrototype,
   RegExpPrototypeExec,
   RegExpPrototypeSymbolReplace,
   RegExpPrototypeSymbolSplit,
@@ -78,6 +90,7 @@ const {
   SetPrototypeGetSize,
   SetPrototypeValues,
   String,
+  StringPrototype,
   StringPrototypeCharCodeAt,
   StringPrototypeCodePointAt,
   StringPrototypeEndsWith,
@@ -106,6 +119,10 @@ const {
   TypedArrayPrototypeGetLength,
   TypedArrayPrototypeGetSymbolToStringTag,
   Uint8Array,
+  WeakMap,
+  WeakMapPrototype,
+  WeakSet,
+  WeakSetPrototype,
   globalThis,
   uncurryThis,
 } = primordials;
@@ -608,21 +625,31 @@ function isInstanceof(object, proto) {
 }
 
 // Special-case for some builtin prototypes in case their `constructor` property has been tampered.
-const wellKnownPrototypes = new SafeMap();
-wellKnownPrototypes.set(ArrayPrototype, { name: 'Array', constructor: Array });
-wellKnownPrototypes.set(ArrayBufferPrototype, { name: 'ArrayBuffer', constructor: ArrayBuffer });
-wellKnownPrototypes.set(FunctionPrototype, { name: 'Function', constructor: Function });
-wellKnownPrototypes.set(MapPrototype, { name: 'Map', constructor: Map });
-wellKnownPrototypes.set(ObjectPrototype, { name: 'Object', constructor: Object });
-wellKnownPrototypes.set(SetPrototype, { name: 'Set', constructor: Set });
-wellKnownPrototypes.set(TypedArrayPrototype, { name: 'TypedArray', constructor: TypedArray });
+const wellKnownPrototypes = new SafeMap()
+  .set(ArrayPrototype, { name: 'Array', constructor: Array })
+  .set(ArrayBufferPrototype, { name: 'ArrayBuffer', constructor: ArrayBuffer })
+  .set(FunctionPrototype, { name: 'Function', constructor: Function })
+  .set(MapPrototype, { name: 'Map', constructor: Map })
+  .set(SetPrototype, { name: 'Set', constructor: Set })
+  .set(ObjectPrototype, { name: 'Object', constructor: Object })
+  .set(TypedArrayPrototype, { name: 'TypedArray', constructor: TypedArray })
+  .set(RegExpPrototype, { name: 'RegExp', constructor: RegExp })
+  .set(DatePrototype, { name: 'Date', constructor: Date })
+  .set(DataViewPrototype, { name: 'DataView', constructor: DataView })
+  .set(ErrorPrototype, { name: 'Error', constructor: Error })
+  .set(BooleanPrototype, { name: 'Boolean', constructor: Boolean })
+  .set(NumberPrototype, { name: 'Number', constructor: Number })
+  .set(StringPrototype, { name: 'String', constructor: String })
+  .set(PromisePrototype, { name: 'Promise', constructor: Promise })
+  .set(WeakMapPrototype, { name: 'WeakMap', constructor: WeakMap })
+  .set(WeakSetPrototype, { name: 'WeakSet', constructor: WeakSet });
 
 function getConstructorName(obj, ctx, recurseTimes, protoProps) {
   let firstProto;
   const tmp = obj;
   while (obj || isUndetectableObject(obj)) {
     const wellKnownPrototypeNameAndConstructor = wellKnownPrototypes.get(obj);
-    if (wellKnownPrototypeNameAndConstructor != null) {
+    if (wellKnownPrototypeNameAndConstructor !== undefined) {
       const { name, constructor } = wellKnownPrototypeNameAndConstructor;
       if (FunctionPrototypeSymbolHasInstance(constructor, tmp)) {
         if (protoProps !== undefined && firstProto !== obj) {