fix(relay-runtime): prototype less payloads (#5043)

Summary:
Relay throws an error when execution and consumption occur in the same thread without a serialization boundary (no JSON.parse()). This occurs because popular execution library have prototype less object (to allow keys like constructor etc.). Relay should not assume payload has any method available.

graphql-js: https://github.com/graphql/graphql-js/blob/16.x.x/src/execution/execute.ts#L298
supermassive: https://github.com/microsoft/graphitation/blob/main/packages/supermassive/src/executeWithoutSchema.ts#L201

Pull Request resolved: #5043

Reviewed By: evanyeung

Differential Revision: D79271386

Pulled By: captbaritone

fbshipit-source-id: f68c8f789e959350afeaf01ab794053c6cba20f7

Author: pavelglac

packages/relay-runtime/store/RelayResponseNormalizer.js

@@ -250,7 +250,11 @@ class RelayResponseNormalizer {
               this._traverseSelections(selection, record, data);
             }
           } else {
-            const implementsInterface = data.hasOwnProperty(abstractKey);
+            // $FlowFixMe[method-unbinding] - data could be prototype less
+            const implementsInterface = Object.prototype.hasOwnProperty.call(
+              data,
+              abstractKey,
+            );
             const typeName = RelayModernRecord.getType(record);
             const typeID = generateTypeID(typeName);
             let typeRecord = this._recordSource.get(typeID);
@@ -271,7 +275,11 @@ class RelayResponseNormalizer {
         }
         case 'TypeDiscriminator': {
           const {abstractKey} = selection;
-          const implementsInterface = data.hasOwnProperty(abstractKey);
+          // $FlowFixMe[method-unbinding] - data could be prototype less
+          const implementsInterface = Object.prototype.hasOwnProperty.call(
+            data,
+            abstractKey,
+          );
           const typeName = RelayModernRecord.getType(record);
           const typeID = generateTypeID(typeName);
           let typeRecord = this._recordSource.get(typeID);

packages/relay-runtime/store/__tests__/RelayResponseNormalizer-test.js

@@ -4663,4 +4663,113 @@ describe('RelayResponseNormalizer', () => {
       });
     });
   });
+
+  describe('Prototype-less objects (e.g., from graphql-js executor)', () => {
+    const createPrototypeLessObject = (data: {[string]: mixed}) => {
+      const obj = Object.create(null);
+      // $FlowFixMe[unsafe-object-assign] - assigning to prototype-less object
+      Object.assign(obj, data);
+      return obj;
+    };
+
+    it('normalizes prototype-less payloads with type discriminator', () => {
+      const query = graphql`
+        query RelayResponseNormalizerTest42Query($id: ID!) {
+          node(id: $id) {
+            ...RelayResponseNormalizerTest42Fragment
+          }
+        }
+      `;
+
+      graphql`
+        fragment RelayResponseNormalizerTest42Fragment on Node {
+          id
+          ... on User {
+            name
+          }
+        }
+      `;
+
+      const payload = {
+        node: createPrototypeLessObject({
+          __typename: 'Page',
+          id: '1',
+        }),
+      };
+
+      const recordSource = new RelayRecordSource();
+      recordSource.set(ROOT_ID, RelayModernRecord.create(ROOT_ID, ROOT_TYPE));
+
+      normalize(
+        recordSource,
+        createNormalizationSelector(query.operation, ROOT_ID, {id: '1'}),
+        payload,
+        defaultOptions,
+      );
+
+      expect(recordSource.toJSON()).toEqual({
+        '1': {
+          __id: '1',
+          __typename: 'Page',
+          id: '1',
+        },
+        'client:root': {
+          __id: 'client:root',
+          __typename: '__Root',
+          'node(id:"1")': {__ref: '1'},
+        },
+        'client:__type:Page': {
+          __id: 'client:__type:Page',
+          __typename: '__TypeSchema',
+          __isNode: false,
+        },
+      });
+    });
+
+    it('normalizes prototype-less payloads for union types', () => {
+      const query = graphql`
+        query RelayResponseNormalizerTest43Query($id: ID!) {
+          userOrPage(id: $id) {
+            ... on User {
+              id
+            }
+          }
+        }
+      `;
+
+      const payload = {
+        userOrPage: createPrototypeLessObject({
+          __typename: 'Page',
+          id: '1',
+        }),
+      };
+
+      const recordSource = new RelayRecordSource();
+      recordSource.set(ROOT_ID, RelayModernRecord.create(ROOT_ID, ROOT_TYPE));
+
+      normalize(
+        recordSource,
+        createNormalizationSelector(query.operation, ROOT_ID, {id: '1'}),
+        payload,
+        defaultOptions,
+      );
+
+      expect(recordSource.toJSON()).toEqual({
+        '1': {
+          __id: '1',
+          __typename: 'Page',
+        },
+        'client:root': {
+          __id: 'client:root',
+          __typename: '__Root',
+          'userOrPage(id:"1")': {__ref: '1'},
+        },
+        'client:__type:Page': {
+          __id: 'client:__type:Page',
+          __typename: '__TypeSchema',
+          __isNode: false,
+        },
+      });
+    });
+  });
 });