Skip to content

fix: avoid crash when spread undefined ref#2333

Merged
upupming merged 3 commits intomainfrom
fix/spread-undefined-ref
Mar 13, 2026
Merged

fix: avoid crash when spread undefined ref#2333
upupming merged 3 commits intomainfrom
fix/spread-undefined-ref

Conversation

@upupming
Copy link
Copy Markdown
Collaborator

@upupming upupming commented Mar 13, 2026

Description

Fixed a potential crash in @lynx-js/react when spreading props that include an undefined ref. This occurs because applyRef was being called even when the ref value was null or undefined in a spread object.

Added a regression test in packages/react/testing-library.

Checklist

  • Tests updated (or not required).
  • Documentation updated (or not required).
  • Changeset added, and when a BREAKING CHANGE occurs, it needs to be clearly marked (or not required).

Summary by CodeRabbit

  • Bug Fixes
    • Fixed a crash that occurred when spreading properties containing undefined refs onto React components, improving application stability and reliability.

@upupming upupming requested review from HuJean, Yradex and hzy as code owners March 13, 2026 09:49
@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Mar 13, 2026

🦋 Changeset detected

Latest commit: bde489a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@lynx-js/react Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Mar 13, 2026

📝 Walkthrough

Walkthrough

Adds a patch fix for @lynx-js/react to prevent crashes when spreading undefined refs. The fix guards against applying falsy refs in the removeChild cleanup method and includes a test case validating the behavior.

Changes

Cohort / File(s) Summary
Changeset metadata
.changeset/fix-spread-undefined-ref.md
Documents patch release for @lynx-js/react addressing undefined ref spread crash.
Ref cleanup guard
packages/react/runtime/src/backgroundSnapshot.ts
Adds truthy check for value.ref before calling applyRef in removeChild to prevent applying falsy refs.
Test coverage
packages/react/testing-library/src/__tests__/ref.test.jsx
Adds test case "spread undefined ref should work" verifying that spreading undefined ref onto a component works without error.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

Suggested labels

framework:React

Suggested reviewers

  • HuJean
  • Yradex
  • hzy

Poem

🐰 A ref spread undefined? Oh what a fright!
But now with a guard, everything's right!
We check if it's truthy before we apply,
No crashes today—just smooth sailing by! ✨

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main fix: avoiding a crash when spreading undefined refs, which aligns with the primary code change in backgroundSnapshot.ts and the regression test added.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
  • 📝 Generate docstrings (stacked PR)
  • 📝 Generate docstrings (commit on current branch)
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix/spread-undefined-ref
📝 Coding Plan
  • Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
packages/react/testing-library/src/__tests__/ref.test.jsx (1)

481-484: Add one post-toggle assertion to prove the unmount path executed.

This keeps the regression test explicit instead of only relying on “no throw”.

✅ Suggested test hardening
   act(() => {
     setShowChild(false);
   });
+  expect(elementTree).toMatchInlineSnapshot(`<page />`);
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@packages/react/testing-library/src/__tests__/ref.test.jsx` around lines 481 -
484, After calling act(() => { setShowChild(false); }) add a concrete assertion
that the unmount path executed (don’t just rely on "no throw"); for example, use
the test utilities used earlier in the file (queryByText/queryByTestId or
container) to assert the child is removed from the DOM (e.g.
expect(queryByTestId('child') or queryByText('child label')).toBeNull() or
expect(container).not.toContainElement(childElement)), or assert any unmount
callback/flag used in the test was called (e.g.
expect(onUnmountMock).toHaveBeenCalled()) so the test explicitly verifies the
unmount path after setShowChild and act.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@packages/react/testing-library/src/__tests__/ref.test.jsx`:
- Around line 481-484: After calling act(() => { setShowChild(false); }) add a
concrete assertion that the unmount path executed (don’t just rely on "no
throw"); for example, use the test utilities used earlier in the file
(queryByText/queryByTestId or container) to assert the child is removed from the
DOM (e.g. expect(queryByTestId('child') or queryByText('child
label')).toBeNull() or expect(container).not.toContainElement(childElement)), or
assert any unmount callback/flag used in the test was called (e.g.
expect(onUnmountMock).toHaveBeenCalled()) so the test explicitly verifies the
unmount path after setShowChild and act.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8cf987e8-5c9e-4c64-88e7-e8770dc4b60f

📥 Commits

Reviewing files that changed from the base of the PR and between 045320e and bde489a.

📒 Files selected for processing (3)
  • .changeset/fix-spread-undefined-ref.md
  • packages/react/runtime/src/backgroundSnapshot.ts
  • packages/react/testing-library/src/__tests__/ref.test.jsx

@codecov
Copy link
Copy Markdown

codecov bot commented Mar 13, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

@upupming upupming enabled auto-merge (squash) March 13, 2026 10:26
@relativeci
Copy link
Copy Markdown

relativeci bot commented Mar 13, 2026

Web Explorer

#8141 Bundle Size — 384.5KiB (0%).

bde489a(current) vs 045320e main#8139(baseline)

Bundle metrics  Change 1 change
                 Current
#8141
     Baseline
#8139
No change  Initial JS 155.59KiB 155.59KiB
No change  Initial CSS 35.1KiB 35.1KiB
No change  Cache Invalidation 0% 0%
No change  Chunks 8 8
No change  Assets 8 8
Change  Modules 238(-0.42%) 239
No change  Duplicate Modules 16 16
No change  Duplicate Code 2.98% 2.98%
No change  Packages 4 4
No change  Duplicate Packages 0 0
Bundle size by type  no changes
                 Current
#8141
     Baseline
#8139
No change  JS 253.55KiB 253.55KiB
No change  Other 95.85KiB 95.85KiB
No change  CSS 35.1KiB 35.1KiB

Bundle analysis reportBranch fix/spread-undefined-refProject dashboard


Generated by RelativeCIDocumentationReport issue

@upupming upupming merged commit d10ddb7 into main Mar 13, 2026
99 of 103 checks passed
@upupming upupming deleted the fix/spread-undefined-ref branch March 13, 2026 12:34
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq bot commented Mar 13, 2026

Merging this PR will degrade performance by 8.37%

⚡ 1 improved benchmark
❌ 1 regressed benchmark
✅ 70 untouched benchmarks
⏩ 3 skipped benchmarks1

⚠️ Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

Benchmark BASE HEAD Efficiency
basic-performance-nest-level-100 6.8 ms 7.4 ms -8.37%
basic-performance-text-200 19 ms 17.7 ms +7.27%

Comparing fix/spread-undefined-ref (bde489a) with main (045320e)

Open in CodSpeed

Footnotes

  1. 3 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports.

colinaaa pushed a commit that referenced this pull request Mar 24, 2026
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @lynx-js/react@0.117.0

### Minor Changes

- feat: export `GlobalPropsProvider`, `GlobalPropsConsumer`,
`useGlobalProps` and `useGlobalPropsChanged` for `__globalProps`
([#2346](#2346))

- `GlobalPropsProvider`: A Provider component that accepts `children`.
It is used to provide the `lynx.__globalProps` context.
- `GlobalPropsConsumer`: A Consumer component that accepts a function as
a child. It is used to consume the `lynx.__globalProps` context.
- `useGlobalProps`: A hook that returns the `lynx.__globalProps` object.
It triggers a re-render when `lynx.__globalProps` changes.
- `useGlobalPropsChanged`: A hook that accepts a callback function. The
callback is invoked when `lynx.__globalProps` changes.

Note: When `globalPropsMode` is not set to `'event'` (default is
`'reactive'`), these APIs will be ineffective (pass-through) and will
log a warning in development mode, as updates are triggered
automatically by full re-render.

- **BREAKING CHANGE**:
([#2319](#2319))

Change preact package from `@hongzhiyuan/preact` to
`@lynx-js/internal-preact`.

Upgrade preact from
[f7693b72](preactjs/preact@f7693b7)
to
[55254ef7](preactjs/preact@55254ef),
see diffs at
[f7693b72...55254ef7](https://github.com/preactjs/preact/compare/f7693b72ecb4a40c66e6e47f54e2d4edc374c9f0...preactjs:preact:55254ef7021e563cc1a86fb816058964a1b6a29a?expand=1).

- feat: add `globalPropsMode` option to `PluginReactLynxOptions`
([#2346](#2346))

- When configured to `"event"`, `updateGlobalProps` will only trigger a
global event and skip the `runWithForce` flow.
- Defaults to `"reactive"`, which means `updateGlobalProps` will trigger
re-render automatically.

### Patch Changes

- Add `__BACKGROUND__` guard on `onBackgroundSnapshotInstanceUpdateId`
event to prevent bundling to main-thread on dev environment.
([#2332](#2332))

- refactor: extract static string in template literal
([#2334](#2334))

- fix: avoid crash when spread undefined ref
([#2333](#2333))

- Avoid registering lifecycle refs for main-thread functions (MTF) that
have not received an `execId` during `renderPage()` first-screen
binding. ([#2320](#2320))

## @lynx-js/react-umd@0.117.0

### Minor Changes

- Add standalone UMD build of the ReactLynx runtime.
([#2331](#2331))

## @lynx-js/react-rsbuild-plugin@0.13.0

### Minor Changes

- **BREAKING CHANGE**:
([#2319](#2319))

Change preact package from `@hongzhiyuan/preact` to
`@lynx-js/internal-preact`.

Upgrade preact from
[f7693b72](preactjs/preact@f7693b7)
to
[55254ef7](preactjs/preact@55254ef),
see diffs at
[f7693b72...55254ef7](https://github.com/preactjs/preact/compare/f7693b72ecb4a40c66e6e47f54e2d4edc374c9f0...preactjs:preact:55254ef7021e563cc1a86fb816058964a1b6a29a?expand=1).

- feat: add `globalPropsMode` option to `PluginReactLynxOptions`
([#2346](#2346))

- When configured to `"event"`, `updateGlobalProps` will only trigger a
global event and skip the `runWithForce` flow.
- Defaults to `"reactive"`, which means `updateGlobalProps` will trigger
re-render automatically.

### Patch Changes

- Updated dependencies
\[[`f1129ea`](f1129ea),
[`27f1cff`](27f1cff),
[`ed566f0`](ed566f0),
[`402ec2b`](402ec2b)]:
    -   @lynx-js/react-webpack-plugin@0.8.0
    -   @lynx-js/react-refresh-webpack-plugin@0.3.5
    -   @lynx-js/react-alias-rsbuild-plugin@0.13.0
    -   @lynx-js/use-sync-external-store@1.5.0
    -   @lynx-js/template-webpack-plugin@0.10.6
    -   @lynx-js/css-extract-webpack-plugin@0.7.0

## @lynx-js/react-webpack-plugin@0.8.0

### Minor Changes

- feat: add `globalPropsMode` option to `PluginReactLynxOptions`
([#2346](#2346))

- When configured to `"event"`, `updateGlobalProps` will only trigger a
global event and skip the `runWithForce` flow.
- Defaults to `"reactive"`, which means `updateGlobalProps` will trigger
re-render automatically.

### Patch Changes

- Fix sourcemap misalignment when wrapping lazy bundle main-thread
chunks. ([#2361](#2361))

The lazy bundle IIFE wrapper is now injected in `processAssets` at
`PROCESS_ASSETS_STAGE_OPTIMIZE_SIZE + 1` by walking chunk groups instead
of patching assets in `beforeEncode`.

- With `experimental_isLazyBundle: true`, the wrapper is applied to
lazy-bundle chunk groups.
- Without lazy bundle mode, the wrapper is applied to async main-thread
chunk groups generated by dynamic import.

Injecting the wrapper in this stage keeps the emitted JS stable after
optimization while still running before `DEV_TOOLING` sourcemap
finalization, so the generated `.js` and `.js.map` stay aligned.

- Set `__DEV__` and `__PROFILE__` to `true` on `NODE_ENV ===
'development'`.
([#2324](#2324))

## @lynx-js/rspeedy@0.13.6

### Patch Changes

- Rename Web Preview label to fix URL alignment
([#2355](#2355))

- Updated dependencies
\[[`799fda8`](799fda8)]:
    -   @lynx-js/cache-events-webpack-plugin@0.0.3
    -   @lynx-js/web-rsbuild-server-middleware@0.19.9

## @lynx-js/lynx-bundle-rslib-config@0.2.3

### Patch Changes

- Fix snapshot not found error when dev with external bundle
([#2316](#2316))

## @lynx-js/external-bundle-rsbuild-plugin@0.0.4

### Patch Changes

- Updated dependencies
\[[`ed566f0`](ed566f0)]:
    -   @lynx-js/externals-loading-webpack-plugin@0.0.5

## @lynx-js/kitten-lynx-test-infra@0.1.1

### Patch Changes

- feat: support page.screenshot()
([#2364](#2364))

- feat: initial commit
([#2272](#2272))

## @lynx-js/testing-environment@0.1.12

### Patch Changes

- Implement `__ElementAnimate` PAPI for web platform animation lifecycle
([#2329](#2329))

## @lynx-js/web-constants@0.19.9

### Patch Changes

- Implement `__ElementAnimate` PAPI for web platform animation lifecycle
([#2329](#2329))

-   Updated dependencies \[]:
    -   @lynx-js/web-worker-rpc@0.19.9

## @lynx-js/web-core@0.19.9

### Patch Changes

- Updated dependencies
\[[`2efecc2`](2efecc2)]:
    -   @lynx-js/web-constants@0.19.9
    -   @lynx-js/web-mainthread-apis@0.19.9
    -   @lynx-js/web-worker-runtime@0.19.9
    -   @lynx-js/web-worker-rpc@0.19.9

## @lynx-js/web-core-wasm@0.0.6

### Patch Changes

- reexports essential utils & types in @lynx-js/web-elements from
@lynx-js/web-core-wasm/client
([#2321](#2321))

-   Updated dependencies \[]:
    -   @lynx-js/web-worker-rpc@0.19.9

## @lynx-js/web-mainthread-apis@0.19.9

### Patch Changes

- Updated dependencies
\[[`2efecc2`](2efecc2)]:
    -   @lynx-js/web-constants@0.19.9

## @lynx-js/web-worker-runtime@0.19.9

### Patch Changes

- Updated dependencies
\[[`2efecc2`](2efecc2)]:
    -   @lynx-js/web-constants@0.19.9
    -   @lynx-js/web-mainthread-apis@0.19.9
    -   @lynx-js/web-worker-rpc@0.19.9

## @lynx-js/cache-events-webpack-plugin@0.0.3

### Patch Changes

- Cache `globalThis.loadDynamicComponent` in the cache events runtime
and add tests covering tt methods, performance events, and globalThis
replay behavior.
([#2343](#2343))

## @lynx-js/externals-loading-webpack-plugin@0.0.5

### Patch Changes

- Fix snapshot not found error when dev with external bundle
([#2316](#2316))

## @lynx-js/react-refresh-webpack-plugin@0.3.5

### Patch Changes

- Fix snapshot not found error when dev with external bundle
([#2316](#2316))

## @lynx-js/template-webpack-plugin@0.10.6

### Patch Changes

- Updated dependencies
\[[`d034dae`](d034dae)]:
    -   @lynx-js/web-core-wasm@0.0.6

## create-rspeedy@0.13.6



## @lynx-js/react-alias-rsbuild-plugin@0.13.0



## upgrade-rspeedy@0.13.6



## @lynx-js/web-core-server@0.19.9



## @lynx-js/web-rsbuild-server-middleware@0.19.9



## @lynx-js/web-worker-rpc@0.19.9

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants