Skip to content

fix(devtools): handle null-prototype object previews#68869

Closed
puneetdixit200 wants to merge 1 commit into
angular:mainfrom
puneetdixit200:fix/68798-devtools-null-prototype
Closed

fix(devtools): handle null-prototype object previews#68869
puneetdixit200 wants to merge 1 commit into
angular:mainfrom
puneetdixit200:fix/68798-devtools-null-prototype

Conversation

@puneetdixit200
Copy link
Copy Markdown

PR Checklist

Please check if your PR fulfills the following requirements:

PR Type

What kind of change does this PR introduce?

  • Bugfix
  • Feature
  • Code style update (formatting, local variables)
  • Refactoring (no functional changes, no api changes)
  • Build related changes
  • CI related changes
  • Documentation content changes
  • angular.dev application / infrastructure changes
  • Other... Please describe:

What is the current behavior?

Issue Number: #68798

Angular DevTools can throw while previewing component state values created with Object.create(null) or Object.groupBy(), because the serializer assumes object values always have a constructor. Expanding selected nested properties also assumes hasOwnProperty exists on the object itself.

What is the new behavior?

Null-prototype objects are previewed as plain objects, and selected nested properties are checked with Object.prototype.hasOwnProperty.call. The DevTools state serializer can inspect those values without throwing.

Does this PR introduce a breaking change?

  • Yes
  • No

Other information

Local checks:

  • ./node_modules/.bin/prettier --check devtools/projects/ng-devtools-backend/src/lib/state-serializer/object-utils.ts devtools/projects/ng-devtools-backend/src/lib/state-serializer/serialized-descriptor-factory.ts devtools/projects/ng-devtools-backend/src/lib/state-serializer/state-serializer.spec.ts
  • git diff --check
  • ./node_modules/.bin/bazelisk --output_user_root="$PWD/.bazel-user-root" test -- //devtools/projects/ng-devtools-backend/src/lib/state-serializer:test

@google-cla
Copy link
Copy Markdown

google-cla Bot commented May 21, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@pullapprove pullapprove Bot requested a review from hawkgs May 21, 2026 18:52
@ngbot ngbot Bot added this to the Backlog milestone May 21, 2026
Guard DevTools serializer previews against objects without a constructor and use Object.prototype.hasOwnProperty.call when expanding selected nested properties. This keeps Object.groupBy and Object.create(null) values inspectable instead of throwing while rendering component state.

Fixes angular#68798
@puneetdixit200 puneetdixit200 force-pushed the fix/68798-devtools-null-prototype branch from c06179a to 5cf07de Compare May 21, 2026 18:53
@JeanMeche
Copy link
Copy Markdown
Member

Superseeded by #68879

@JeanMeche JeanMeche closed this May 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants