FED-358 Work around identityHashCode throwing for non-extensible objects

[greglittlefield-wf]

Motivation

Currently, when jsifyAndAllowInterop encounters a non-JsObject frozen object, such as the frozen children array of a JSX Element, it throws as a result of identityHashCode trying to write a property on it (Dart SDK issue: https://github.com/dart-lang/sdk/issues/36354).

This can occur when wrapping JS components in Dart and forwarding props that contain frozen arrays them to another component.

Uncaught TypeError: Cannot add property Symbol(_identityHashCode), object is not extensible
    at Object.identityHashCode (core_patch.dart:41:42)
    at CustomHashMap.new._jsObjectFriendlyIdentityHashCode (js_interop_helpers.dart:16:51)
    at CustomHashMap.new.containsKey (custom_hash_map.dart:72:70)
    at _convert (js_interop_helpers.dart:84:26)
    at _convert (js_interop_helpers.dart:91:40)
    at Object._convertDataTree (js_interop_helpers.dart:108:10)
    at Object.jsifyAndAllowInterop (js_interop_helpers.dart:75:10)
    at Object.generateJsProps (factory_util.dart:123:26)
    at component_factory.ReactDomComponentFactoryProxy.new.build (component_factory.dart:304:26)
    at dom_components.DomProps.new.call (component_base.dart:639:29)

Note that this error only happens in DDC, since dart2js does not run in strict mode

Solution

• Wrap call to identityHashCode in a try-catch, and fall back to a safe implementation
• Update code comments
• Add regression tests.

Testing

• Verify regression tests pass in DDC (i.e., CI passes)

Release notes

• Fix identityHashCode error when forwarding props containing JSX children

[aviary3-wk]

Security Insights

(3) Vulnerable direct dependencies were detected

1 vulns in ansi-regex < 4.1.1 via yarn.lock

1 vulns in glob-parent < 5.1.2 via yarn.lock

1 vulns in terser < 4.8.1 via yarn.lock

Action Items

• Review dependencies for available updates
• See this Splunk dashboard for more CVE details
• Review PR for security impact; comment "security review required" if needed or unsure

• Verify aviary.yaml coverage of security relevant code

  Questions or Comments? Reach out on Slack: #support-infosec.

[joebingham-wk]

QA +1

[greglittlefield-wf]

@Workiva/release-management-p