[Bug] assert.strictEqual OOM on objects with deeply shared references

Version

v25.2.1

Platform

Darwin Hafezs-MacBook-Pro.local 25.2.0 Darwin Kernel Version 25.2.0: Tue Nov 18 21:09:40 PST 2025; root:xnu-12377.61.12~1/RELEASE_ARM64_T6000 arm64

Subsystem

assert

What steps will reproduce the bug?

// Run with: node --max-old-space-size=512 repro.js
'use strict';
const assert = require('assert');

// Create an object graph where many unique paths converge on shared objects.
// This delays circular reference detection and creates exponential growth
// in util.inspect output at high depths.

function createBase() {
  const base = { id: 'base', models: {}, schemas: {}, types: {} };
  for (let i = 0; i < 5; i++) {
    base.types[`type_${i}`] = {
      name: `type_${i}`,
      base,
      caster: { base, name: `type_${i}_caster` },
      options: {
        base,
        validators: [
          { base, name: 'v1' },
          { base, name: 'v2' },
          { base, name: 'v3' },
        ],
      },
    };
  }
  return base;
}

function createSchema(base, name) {
  const schema = { name, base, paths: {}, tree: {}, virtuals: {} };
  for (let i = 0; i < 10; i++) {
    schema.paths[`field_${i}`] = {
      path: `field_${i}`,
      schema,
      instance: base.types[`type_${i % 5}`],
      options: {
        type: base.types[`type_${i % 5}`],
        validators: [
          { validator: () => true, base, schema },
          { validator: () => true, base, schema },
        ],
      },
      caster: base.types[`type_${i % 5}`].caster,
    };
  }
  schema.childSchemas = [];
  for (let i = 0; i < 3; i++) {
    const child = { name: `${name}_child_${i}`, base, schema, paths: {} };
    for (let j = 0; j < 5; j++) {
      child.paths[`child_field_${j}`] = {
        path: `child_field_${j}`,
        schema: child,
        instance: base.types[`type_${j % 5}`],
        options: { base, schema: child },
      };
    }
    schema.childSchemas.push(child);
  }
  return schema;
}

const base = createBase();
const schema1 = createSchema(base, 'Schema1');
const schema2 = createSchema(base, 'Schema2');

// These are different objects, so comparison should fail with AssertionError
assert.strictEqual(schema1, schema2);

How often does it reproduce? Is there a required condition?

100% reproducible. The condition is having objects with many unique paths that converge on shared objects (common in ORMs like Mongoose where schemas reference a shared "base" object).

What is the expected behavior? Why is that the expected behavior?

assert.strictEqual should throw an AssertionError with a diff showing the objects are not reference-equal. The error message can be truncated if very large, but the process should not crash.

What do you see instead?

The process crashes with OOM:

FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory

The OOM happens because util.inspect expands each unique path through the object graph separately. For objects where many paths converge on shared objects (common in ORMs), the number of unique paths grows exponentially. With depth: 1000, the expansion runs long enough to produce 100+ MB strings before hitting circular reference markers.

Additional information

This was discovered while working with Mongoose documents. The issue is in lib/internal/assert/assertion_error.js where inspectValue() has no output size limit.

Potential fixes:

1. Truncate inspect output (e.g., at 2MB) before passing to the diff algorithm
2. Skip diff entirely for huge objects - just show "Objects are not equal (output too large to diff)"
3. Smarter truncation - find where objects differ first, truncate around that area. However, this is complex to implement and the performance impact is probably negative compared to current solution: for objects with exponential paths, even traversing them to find differences could be expensive, and the subtree around the difference may still contain references to shared objects that cause the same explosion.

Trade-off with truncation:

If both objects produce very large inspect output and happen to match exactly in the first 2MB but differ later, the diff would appear identical even though the assertion failed. However:

• The alternative is an OOM crash, which is worse
• The assertion result is still correct (=== failed)
• A truncation marker (... [truncated]) indicates output was cut off
• Users can examine error.actual and error.expected programmatically for further investigation

I'm happy to submit a PR with a fix.

Bắt đầu trong lib/internal/assert/assertion_error.js, tập trung vào inspectValue(), sau đó chạy repro.js được cung cấp bằng node --max-old-space-size=512. Hoàn thành khi assert.strictEqual vẫn ném một AssertionError với đầu ra bị giới hạn hoặc cắt ngắn thay vì làm cạn kiệt heap; hãy xem xét cách hành vi diff hiện có nên báo hiệu đầu ra bị cắt ngắn.