lib: use Object.freeze to avoid defensive cloning in SourceMap

PR-URL: #62830
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Author: watilde

doc/api/module.md

@@ -1962,10 +1962,20 @@ generated code.
 
 #### `sourceMap.payload`
 
+<!-- YAML
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62830
+    description: The object is frozen.
+-->
+
 * Returns: {Object}
 
 Getter for the payload used to construct the [`SourceMap`][] instance.
 
+The returned object is frozen with [`Object.freeze()`][], and the same
+reference is returned on every access. Do not mutate the returned object.
+
 #### `sourceMap.findEntry(lineOffset, columnOffset)`
 
 * `lineOffset` {number} The zero-indexed line number offset in
@@ -2050,6 +2060,7 @@ returned object contains the following keys:
 [`NODE_COMPILE_CACHE_PORTABLE=1`]: cli.md#node_compile_cache_portable1
 [`NODE_DISABLE_COMPILE_CACHE=1`]: cli.md#node_disable_compile_cache1
 [`NODE_V8_COVERAGE=dir`]: cli.md#node_v8_coveragedir
+[`Object.freeze()`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze
 [`SourceMap`]: #class-modulesourcemap
 [`initialize`]: #initialize
 [`module.constants.compileCacheStatus`]: #moduleconstantscompilecachestatus

lib/internal/source_map/source_map.js

@@ -71,6 +71,7 @@ const {
   ArrayPrototypePush,
   ArrayPrototypeSlice,
   ArrayPrototypeSort,
+  ObjectFreeze,
   ObjectPrototypeHasOwnProperty,
   StringPrototypeCharAt,
   Symbol,
@@ -144,15 +145,15 @@ class SourceMap {
     this.#payload = cloneSourceMapV3(payload);
     this.#parseMappingPayload();
     if (ArrayIsArray(lineLengths) && lineLengths.length) {
-      this.#lineLengths = lineLengths;
+      this.#lineLengths = ObjectFreeze(ArrayPrototypeSlice(lineLengths));
     }
   }
 
   /**
    * @returns {object} raw source map v3 payload.
    */
   get payload() {
-    return cloneSourceMapV3(this.#payload);
+    return this.#payload;
   }
 
   get [kMappings]() {
@@ -163,10 +164,7 @@ class SourceMap {
    * @returns {number[] | undefined} line lengths of generated source code
    */
   get lineLengths() {
-    if (this.#lineLengths) {
-      return ArrayPrototypeSlice(this.#lineLengths);
-    }
-    return undefined;
+    return this.#lineLengths;
   }
 
   #parseMappingPayload = () => {
@@ -366,10 +364,10 @@ function cloneSourceMapV3(payload) {
   for (const key in payload) {
     if (ObjectPrototypeHasOwnProperty(payload, key) &&
         ArrayIsArray(payload[key])) {
-      payload[key] = ArrayPrototypeSlice(payload[key]);
+      payload[key] = ObjectFreeze(ArrayPrototypeSlice(payload[key]));
     }
   }
-  return payload;
+  return ObjectFreeze(payload);
 }
 
 /**

test/parallel/test-source-map-api.js

@@ -140,6 +140,14 @@ const { readFileSync } = require('fs');
   assert.notStrictEqual(payload, sourceMap.payload);
   assert.strictEqual(payload.sources[0], sourceMap.payload.sources[0]);
   assert.notStrictEqual(payload.sources, sourceMap.payload.sources);
+  // The payload and its arrays should be frozen to avoid unnecessary cloning:
+  assert(Object.isFrozen(sourceMap.payload));
+  assert(Object.isFrozen(sourceMap.payload.sources));
+  // The same frozen object is returned on each call:
+  assert.strictEqual(sourceMap.payload, sourceMap.payload);
+  // lineLengths should be frozen and return the same reference each call:
+  assert(Object.isFrozen(sourceMap.lineLengths));
+  assert.strictEqual(sourceMap.lineLengths, sourceMap.lineLengths);
 }
 
 // findEntry() and findOrigin() must return empty object instead of
@@ -178,6 +186,11 @@ const { readFileSync } = require('fs');
   assert.notStrictEqual(payload, sourceMap.payload);
   assert.strictEqual(payload.sources[0], sourceMap.payload.sources[0]);
   assert.notStrictEqual(payload.sources, sourceMap.payload.sources);
+  // The payload and its arrays should be frozen to avoid unnecessary cloning:
+  assert(Object.isFrozen(sourceMap.payload));
+  assert(Object.isFrozen(sourceMap.payload.sources));
+  // The same frozen object is returned on each call:
+  assert.strictEqual(sourceMap.payload, sourceMap.payload);
 }
 
 // Test various known decodings to ensure decodeVLQ works correctly.