fix(LCS): use Object.create(null) so prototype members don't shadow lookups

[breferrari]

Fixes #86.

LCS stores equivalence classes in a plain object, so input elements that happen to match Object.prototype member names (constructor, __proto__, toString, hasOwnProperty, ...) read the inherited value instead of undefined and crash on the next line with:

TypeError: equivalenceClasses[item].push is not a function

Swapping the literal for Object.create(null) gives the lookup table no prototype chain, so it only sees keys we wrote. Zero API change — same bracket access semantics, just no inheritance.

 function LCS(buffer1, buffer2) {
-  let equivalenceClasses = {};
+  let equivalenceClasses = Object.create(null);

Added a regression test to test/LCS.test.js covering the common prototype names. The test fails on main with the original TypeError; passes with the fix.

bun run all is clean (lint, build, 30/30 tests).

[Copilot]

Pull request overview

This PR fixes a crash in LCS when input elements match Object.prototype member names by switching its lookup table to a prototype-less object, and adds a regression test to prevent reintroduction.

Changes:

• Replace the LCS equivalence-class lookup table {} with Object.create(null) to avoid prototype shadowing.
• Add a regression test that exercises common Object.prototype member names as input elements.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/diff3.mjs	Uses a prototype-less object for equivalenceClasses to prevent inherited keys from breaking lookups.
test/LCS.test.js	Adds a regression test covering problematic prototype member names.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bhousel]

Thanks!

[breferrari]

@bhousel thanks for merging this! 🙏

Would you be open to cutting a release that includes it? It looks like 45aefd4 and a handful of other commits have landed on main since v3.2.0, so a patch or minor publish would let downstream packages pick up the prototype-lookup fix from the registry.

For context on why it'd be handy: I depend on node-diff3 for a three-way merge engine in my project, and I currently ship a LineInterner workaround that pre-maps every line to an integer token specifically to dodge the Object.prototype collision this PR fixes. Once a release is out I can drop that shim and depend on the fix directly.

No rush at all, just flagging in case it's an easy one to batch. Thanks again for the library!