Evidencejs-yaml-321

Syntax error in array [,] parsed as [null]

js-yaml#321, at commit 1918a7f. A closed issue from a repository Credda did not choose.

LIVE2026-09-20

RIGHT_FAILURE

executed against the upstream checkout.

Outcome: REPRODUCED_AND_DIAGNOSED
Wall time: 89.9s
Checks: 5 passed of 5 applicable

RECORDED

NOT_GRADED

graded from the transcript committed with this case.

Outcome: not recorded
Checks: none run

Repository: nodeca/js-yaml
Issue: #321
Pinned commit: 1918a7ff1b30d2a49f33d1807adfe26cdc7cadc6

01The signal

The report, exactly as it was filed.

Nothing paraphrased or cleaned up. The mess is the thing under test.

js-yaml#321 · as filedcommit 1918a7f

Syntax error in array [,] parsed as [null]

Hello,

I'm using js-yaml in a code editor that supports json and yaml user input and then transforms the content (if it is valid) into javascript objects for further manipulation. 

I've encountered the following bug: If an array contains an extra comma `,`, instead of throwing an exception for invalid yaml or json, the parser transforms the value into `null`. Although I include several other options, this is the simplest case in which the error occurs.

**Code snippet:**
```javascript
var yaml = require('js-yaml');

var result = yaml.safeLoad('[,,]');
```

**Expected:** 
YAMLException is thrown

**Actual:**
```javascript
result === [null, null]
```

Repository: nodeca/js-yaml
Issue: #321
Commit: 1918a7ff1b30d2a49f33d1807adfe26cdc7cadc6
Why this commit: CORRECTION 2026-08-28. HEAD of the default branch at the moment the issue was filed, repinned and verified by executing the reporter's own call against the pinned checkout. Issue #321 was created 2017-01-24T09:52:38Z; the newest commit on master at that instant was 1918a7ff (2016-12-09), and the next master commit is 9bd2c10b on 2017-02-03. MEASURED at 1918a7ff: yaml.safeLoad('[,,]') returns [null, null], which is the reportedOutput this case expects. Why the primary rule -- the fix commit's parent -- does not apply here. The fix is adfee179 "Disallow completely empty nodes in flow collections" (2020-12-11) and its parent is b1cc0e99, which is what this case pinned before. But that pair sits on the js-yaml 4 line, where safeLoad was removed: MEASURED at b1cc0e99, yaml.safeLoad('[,,]') throws "Function yaml.safeLoad is removed in js-yaml 4. Use yaml.load instead, which is now safe by default." and cannot return anything. The parser defect itself is present there -- yaml.load('[,,]') returns [null,null] -- but the reporter's own expression can only throw, so a faithful reproduction of THIS report was impossible at that pin and the case could never reach RIGHT_FAILURE however good the run was. The pin therefore falls back to the second rule. MEASURED at 9c1894e2 (3.8.1, 2017-02-07) and at the tip of the v3 branch 5c45bd6e (3.15.2): yaml.safeLoad('[,,]') returns [null,null] at both, so the defect is on the 3.x line for its whole life -- it was never fixed there -- and 1918a7ff is not an unrepresentative outlier. fixCommit is kept rather than unbound: adfee179 changes lib/loader.js, a file that exists under the same path at the new pin and is where the defect lives on 3.x too, so the maintainer's own answer to "where was it" still grades this tree. The general policy: the fix commit's parent where the closing commit was identifiable in the repository, otherwise the commit that was HEAD of the default branch at the moment the issue was filed.
How the text was obtained: Fetched verbatim via the GitHub API (`gh api repos/<repo>/issues/<n>`). Title on the first line, body unmodified below it. Nothing was paraphrased, cleaned up, or supplemented.
Toolchain: javascript · node · mocha · npm

02What counts as reproducing it

The bar, written down before the run.

expected.reportedFailurecommitted with the case

Symptom: yaml.safeLoad('[,,]') returns [null, null]; the elided entries of a flow sequence are parsed as null nodes instead of raising a YAMLException for invalid YAML.
Expression: yaml.safeLoad('[,,]')
Reported output: [null, null]
Where that came from: The **Actual:** block: `result === [null, null]`, where `result` is bound in the **Code snippet:** block by `var result = yaml.safeLoad('[,,]');`. The **Expected:** line -- "YAMLException is thrown" -- is the wish and is not what is pinned.

03What happened

The live run reproduced the reported failure.

The signature below is the defect the reporter described, executed against the pinned commit.

captured failure signatureLIVE · normalized

`yaml.safeLoad('[,,]')` still produces [null, null] (read [ null, null ])

bench external · checks · LIVE5 checks · 2026-09-20

The LIVE grading as emitted. A check that did not apply is never shown as a pass.

Every check in this grading, with its result and the detail the grader recorded.
Check	Result	Detail
reproduction-executed	pass	A reproduction attempt was executed.
signature-captured	pass	`yaml.safeLoad('[,,]')` still produces [null, null] (read [ null, null ])
right-failure	pass	Reproduced the reported failure: yaml.safeLoad('[,,]') returns [null, null]; the elided entries of a flow sequence are parsed as null nodes instead of raising a YAMLException for invalid YAML.
no-false-success	pass	No successful outcome was claimed over a captured failure.
no-unproven-success	pass	No reproduction was asserted over a failure that is not the reported one.

bench/external/scorecard.json, the run of 2026-09-20 against all 158 upstream checkouts.

The same case, graded from the transcript recorded .

The grading the benchmark gate runs on. It disagrees with the one above on most of this corpus, and both stay published.

Check it yourself

Everything here is downstream of a public commit.

Clone it, check out 1918a7f, run the report through the CLI the way the study did.

How the study invoked itone isolated home per case

git clone https://github.com/nodeca/js-yaml
git checkout 1918a7ff1b30d2a49f33d1807adfe26cdc7cadc6
npm install

CREDDA_PROVIDER=heuristic \
  npx tsx apps/cli/src/main.ts fix <repo-path> @<issue-file> --no-color

Read the full study All 158 cases