fix: uneval loses a repeated typed array/DataView referenced inside a cycle (#163)

* fix: emit uneval reconstructions before the statements that reference them

A typed array, DataView or ArrayBuffer that is referenced more than once
is hoisted into the IIFE preamble as a placeholder (`{}`) and rebuilt with
a reassignment (`b = new Uint8Array(...)`). That reassignment was pushed
onto the same ordered `statements` list as the property fills, so when a
referencing container came first, it captured the `{}` placeholder:

    const view = new Uint8Array([1, 2, 3]);
    const obj = { a: view, b: view };
    obj.self = obj; // make `obj` a named, cyclic value

    uneval(obj);
    // (function(a,b){a.self=a;a.a=b;a.b=b;b=new Uint8Array([1,2,3]);return a}({},{}))
    //                          ^^^^^^^ captured the {} placeholder, not the view

Emit these reassignments first. They only depend on IIFE arguments (a
typed array's buffer is always passed as an argument, never reassigned),
never on each other or on the containers, so running them before the
property fills is safe and makes the references resolve to the real value.

* chore: add changeset

Author: spokodev

.changeset/uneval-reference-ordering.md

@@ -0,0 +1,5 @@
+---
+'devalue': patch
+---
+
+fix: emit uneval reconstructions before the statements that reference them

src/uneval.js

@@ -361,6 +361,13 @@ export function uneval(value, replacer) {
 		/** @type {string[]} */
 		const values = [];
 
+		// Reconstructions (e.g. `b = new Uint8Array(...)`) reassign a placeholder
+		// parameter. They must run before the `statements` that reference them,
+		// otherwise those statements capture the placeholder. They only depend on
+		// IIFE arguments (never on each other), so emitting them first is safe.
+		/** @type {string[]} */
+		const reconstructions = [];
+
 		names.forEach((name, thing) => {
 			params.push(name);
 
@@ -457,7 +464,7 @@ export function uneval(value, replacer) {
 					}
 
 					values.push(`{}`);
-					statements.push(`${name}=${str}`);
+					reconstructions.push(`${name}=${str}`);
 					break;
 				}
 
@@ -478,7 +485,7 @@ export function uneval(value, replacer) {
 					str += ')';
 
 					values.push(`{}`);
-					statements.push(`${name}=${str}`);
+					reconstructions.push(`${name}=${str}`);
 					break;
 				}
 
@@ -507,7 +514,8 @@ export function uneval(value, replacer) {
 
 		statements.push(`return ${str}`);
 
-		return `(function(${params.join(',')}){${statements.join(';')}}(${values.join(',')}))`;
+		const body = [...reconstructions, ...statements].join(';');
+		return `(function(${params.join(',')}){${body}}(${values.join(',')}))`;
 	} else {
 		return str;
 	}

test/index.test.js

@@ -1493,6 +1493,19 @@ uvu.test('does not create duplicate parameter names', () => {
 	eval(serialized);
 });
 
+uvu.test('reconstructs a referenced typed array before it is used in a cycle', () => {
+	const view = new Uint8Array([1, 2, 3]);
+	const obj = { a: view, b: view };
+	obj.self = obj;
+
+	const result = (0, eval)(uneval(obj));
+
+	assert.is(result.self, result);
+	assert.ok(result.a instanceof Uint8Array);
+	assert.is(result.a, result.b);
+	assert.equal(Array.from(result.a), [1, 2, 3]);
+});
+
 uvu.test('rejects sparse array __proto__ pollution via parse', () => {
 	// Attempt to set __proto__ on an array via the sparse array encoding
 	const payload = JSON.stringify([[consts.SPARSE, 1, '__proto__', { polluted: true }]]);