List of surprising non-invariants

[bakkot]

A lot of vulnerabilities, both in implementations and in user code, come down to mistakenly assuming something is an invariant when it is not.

For example:

• null and undefined are the only two nullish values (document.all)
• .slice (and friends) on arrays and TAs constructs the same kind of array as the underlying one (Symbol.species) (e.g.)

What else?

[ljharb]

In-bounds index access on an array is always safe?

[michaelficarra]

"Objects created as empty literals ({}) have no properties". They have no own-properties, but inherit some from Object.prototype by default, including the __proto__ getters/setters.

[michaelficarra]

"JSON is a subset of JavaScript".

[ljharb]

setTimeout is part of JavaScript

[jugglinmike]

"Any IdentifierReference can be safely guarded with the typeof operator."

[TimothyGu]

Array.isArray(a) implies a is an Array exotic object.

edit: a could also be a Proxy exotic object with an underlying Array exotic object.

[ljharb]

@TimothyGu that one is true, because "is an Array object" is defined by the same thing Array.isArray checks. However, "Array.isArray(a) means a instanceof Array" is definitely a non-invariant.

[ljharb]

@jugglinmike can you elaborate? which can't?

[zloirock]

@ljharb it seems something like this

Object.defineProperty(globalThis, 'x', { get(){ throw 42 } });
// ...
typeof x;

[jugglinmike]

Nice point, @zloirock. For my part, I was considering the so-called "temporal dead zone"

typeof x;
let x;

[TimothyGu]

@ljharb I meant the fact that Array.isArray returns true for Proxy objects whose underlying object is an array. I guess I should rephrase it as: "Array.isArray(a) implies that a is an Array exotic object."

[ljharb]

Ha, i love this list. Thanks for clarifying.

[jugglinmike]

"Every value is strictly equal to itself." / "Every value is loosely equal to itself." (Counter-example: NaN)

[bakkot]

And of course conversely, "if x === y, then they are the same value" (-0/0).

[jugglinmike]

That'd be "x === y", right?

[bakkot]

Sorry, yes. Edited to fix.