Fix sinon.restore() cascade-restoring sub-sandboxes (#2704)

charlieleith · web-flow · commit 66df977a5cb7 · 2026-05-05T21:52:53.000+02:00
The ESM port of `createApi` (#2683, shipped in 21.1.0) replaced `createSandbox: createSandbox` with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection: createSandbox: function createSandbox(config) { const s = createConfiguredSandbox(config); sandbox.getFakes().push(s); return s; } `Sandbox#restore` then walks that collection and calls `.restore()` on each entry. Because a sub-sandbox is itself an entry, every top-level `sinon.restore()` cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits `resetHistory` and `verifyAndRestore`. This is the regression reported in #2701. Restore the pre-21.1 behaviour: hand the root API a direct reference to `createConfiguredSandbox`. Sub-sandboxes are now isolated; only `subSandbox.restore()` (or `verifyAndRestore`) clears their fakes. Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the end. Closes #2701
diff --git a/src/create-sinon-api.js b/src/create-sinon-api.js
@@ -20,11 +20,12 @@ export default function createApi() {
     const sandbox = new Sandbox();
 
     const apiMethods = {
-        createSandbox: function createSandbox(config) {
-            const s = createConfiguredSandbox(config);
-            sandbox.getFakes().push(s);
-            return s;
-        },
+        // `createSandbox` returns an isolated sandbox: its fakes are tracked
+        // on its own collection so consumers can rely on `subSandbox.restore()`
+        // (and only that) for cleanup. Don't push it into the global sandbox's
+        // collection — doing so caused `sinon.restore()` to cascade-restore
+        // sub-sandboxes (regression in 21.1.0, see #2701).
+        createSandbox: createConfiguredSandbox,
         match: samsam.createMatcher,
         restoreObject: restoreObject,
         expectation: expectation,
diff --git a/test/src/create-sinon-api-test.js b/test/src/create-sinon-api-test.js
@@ -17,12 +17,26 @@ describe("create-sinon-api", function () {
         assert.isFunction(sinon.expectation.create);
     });
 
-    it("tracks created sandboxes in the root sandbox collection", function () {
+    it("does not track created sandboxes in the root sandbox collection", function () {
+        // Sub-sandboxes are isolated by design: pushing them into the root
+        // sandbox's collection caused `sinon.restore()` to cascade-restore
+        // sub-sandbox stubs (regression in 21.1.0, see #2701).
         const sinon = createApi();
         const fakes = sinon.getFakes();
         const sandbox = sinon.createSandbox();
 
-        assert.equals(fakes.indexOf(sandbox) !== -1, true);
+        assert.equals(fakes.indexOf(sandbox), -1);
+    });
+
+    it("does not restore sub-sandboxes when the root sandbox is restored", function () {
+        const sinon = createApi();
+        const sandbox = sinon.createSandbox();
+        const target = { method: () => "original" };
+        sandbox.stub(target, "method").returns("stubbed");
+
+        sinon.restore();
+
+        assert.equals(target.method(), "stubbed");
     });
 
     it("tracks stub instance methods in the root sandbox collection", function () {
diff --git a/test/src/sandbox-test.js b/test/src/sandbox-test.js
@@ -2048,7 +2048,11 @@ describe("Sandbox", function () {
     });
 
     describe("nested sandboxes", function () {
-        it("should restore nested sandboxes when the parent is restored", function () {
+        // Sub-sandboxes returned by `parent.createSandbox()` are isolated:
+        // the parent's `restore()` / `resetHistory()` / `verifyAndRestore()`
+        // must not touch the child's fakes or timers. Cascading was a
+        // regression in 21.1.0 (see #2701) and is now reverted.
+        it("should not restore nested sandboxes when the parent is restored", function () {
             const parent = createApi(); // parent is a "sinon-like" sandbox
             const child = parent.createSandbox();
 
@@ -2059,10 +2063,13 @@ describe("Sandbox", function () {
 
             parent.restore();
 
+            assert.equals(myObj.method(), "stubbed");
+
+            child.restore();
             assert.equals(myObj.method(), "original");
         });
 
-        it("should reset history of nested sandboxes when the parent resetHistory is called", function () {
+        it("should not reset history of nested sandboxes when the parent resetHistory is called", function () {
             const parent = createApi();
             const child = parent.createSandbox();
 
@@ -2073,10 +2080,10 @@ describe("Sandbox", function () {
 
             parent.resetHistory();
 
-            assert.isFalse(spy.called);
+            assert.isTrue(spy.calledOnce);
         });
 
-        it("should restore nested sandboxes when the parent verifyAndRestore is called", function () {
+        it("should not restore nested sandboxes when the parent verifyAndRestore is called", function () {
             const parent = createApi();
             const child = parent.createSandbox();
 
@@ -2087,10 +2094,13 @@ describe("Sandbox", function () {
 
             parent.verifyAndRestore();
 
+            assert.equals(myObj.method(), "stubbed");
+
+            child.restore();
             assert.equals(myObj.method(), "original");
         });
 
-        it("should restore fake timers when the parent sandbox is restored", function () {
+        it("should not restore fake timers when the parent sandbox is restored", function () {
             const parent = createApi();
             const child = parent.createSandbox();
 
@@ -2101,6 +2111,9 @@ describe("Sandbox", function () {
 
             parent.restore();
 
+            refute.same(globalContext.Date, originalDate);
+
+            child.restore();
             assert.same(globalContext.Date, originalDate);
         });
     });
