[NO QA] Fix isDeletedAction crash when originalMessage is a string by mountiny · Pull Request #90201 · Expensify/App

mountiny · 2026-05-11T13:46:54Z

Explanation of Change

Some legacy/OldDot report actions (notably card-imported expense-update notifications such as "The <date> <merchant> expense has been updated with official data from an imported card") store a plain string in message/originalMessage instead of the object shape declared by OriginalMessage<T>. isDeletedAction then evaluates 'deleted' in originalMessage, which throws TypeError: Cannot use 'in' operator to search for 'deleted' in <string>. The error propagates up through Array.filter → getFirstVisibleReportActionID → useMemo in ReportActionsList, crashing the report view whenever such a report is opened (e.g. via the Home page Begin CTA on a "Submit X report" task).

The fix has two complementary layers:

Centralized normalization in getOriginalMessage — return undefined for non-object values so the runtime matches the declared OriginalMessage<T> | undefined return type. This protects every current and future '<key>' in originalMessage caller at once (there are 15+ such call sites across the repo).
Defensive typeof === 'object' guard at the isDeletedAction call site — belt‑and‑suspenders, so any future regression in getOriginalMessage (or a caller bypassing it) cannot reintroduce this exact crash. This matches the existing pattern in sibling helpers in the same file (getWhisperedTo, isResolvedActionableWhisper, hasReasoning).

Includes regression unit tests for:

isDeletedAction with a string originalMessage
isDeletedAction with a non-array string message
getFirstVisibleReportActionID over a list containing a legacy string-shaped action (the exact crash chain from production)
getOriginalMessage normalization for string and object inputs

Both new tests fail on main against the pre-fix code, locking in the regression.

Fixed Issues

$ #90198
PROPOSAL: #90198 (proposal is the issue body itself — Sentry-discovered crash, no external proposal flow)

Tests

Apply this branch.
In tests/unit/ReportActionsUtilsTest.ts, the new cases under describe('isDeletedAction', …), describe('getFirstVisibleReportActionID', …) and describe('getOriginalMessage', …) exercise the regression. Run:
```
npx jest tests/unit/ReportActionsUtilsTest.ts
```
All 285 tests pass on this branch.
To verify in‑app: open a report whose history contains a legacy "expense has been updated with official data from an imported card" action (most easily found on accounts with imported card transactions and at least one card‑updated expense) and confirm the report list renders without a crash and without errors in the JS console.
Verify that no errors appear in the JS console.

Offline tests

This is a defensive type guard in a pure function and does not depend on network state. Repro requires only the existing on-device Onyx data; no API calls are involved on the crash path. Toggling offline mode while opening the affected report should yield identical behavior (no crash, list renders).

QA Steps

// [No QA] — Mechanical type guard / fix on a code path that already handles the falsy case correctly. There is no UI or behavioral change for non-affected report actions, and affected report actions simply stop crashing the list. Covered by unit tests.

Verify that no errors appear in the JS console

PR Author Checklist

Screenshots/Videos

N/A — defensive type guard, no UI changes. Affected report actions simply stop crashing the report list.

Android: Native

N/A — no UI changes.

Android: mWeb Chrome

N/A — no UI changes.

iOS: Native

N/A — no UI changes.

iOS: mWeb Safari

N/A — no UI changes.

MacOS: Chrome / Safari

N/A — no UI changes.

Made with Cursor

Some legacy/OldDot report actions (notably card-imported expense-update notifications) store a plain string in `message`/`originalMessage` instead of the object shape declared by `OriginalMessage<T>`. `isDeletedAction` then evaluates `'deleted' in originalMessage`, which throws `TypeError: Cannot use 'in' operator to search for 'deleted' in <string>` and crashes `ReportActionsList` whenever a report containing such an action is opened (e.g. via the Home page "Begin" CTA). Fix it in two layers: 1. Centralize the guard in `getOriginalMessage` so it returns `undefined` for non-object values, matching its declared `OriginalMessage<T> | undefined` return type. This protects every current and future `'<key>' in originalMessage` caller at once. 2. Add a defensive `typeof originalMessage === 'object'` guard at the `isDeletedAction` callsite so any future regression in `getOriginalMessage` (or a caller bypassing it) cannot reintroduce this exact crash. Add regression tests covering: - `isDeletedAction` with a string `originalMessage` - `isDeletedAction` with a non-array string `message` - `getFirstVisibleReportActionID` over a list containing a legacy string-shaped action - `getOriginalMessage` normalization for string and object inputs Fixes #90198 Co-authored-by: Cursor <cursoragent@cursor.com>

melvin-bot · 2026-05-11T13:47:02Z

@eVoloshchak Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

mountiny · 2026-05-11T13:50:00Z

@codex review

Copilot

Pull request overview

Fixes a production crash in the report view caused by legacy report actions where message/originalMessage can be a plain string, which previously caused isDeletedAction to throw when using the in operator.

Changes:

Normalize getOriginalMessage() to return undefined for non-object legacy values (e.g. strings), matching its declared TS contract.
Add a defensive typeof originalMessage === 'object' guard in isDeletedAction() before using the in operator.
Add unit test coverage for the crash chain (isDeletedAction, getFirstVisibleReportActionID, and getOriginalMessage) with legacy string-shaped actions.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
`src/libs/ReportActionsUtils.ts`	Prevents `in`-operator crashes by normalizing/guarding legacy string `originalMessage` values.
`tests/unit/ReportActionsUtilsTest.ts`	Adds regression tests covering legacy string-shaped actions and the production crash path.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

mountiny · 2026-05-11T14:00:06Z

+                message: [{html: 'Hello', type: 'COMMENT', text: 'Hello'}],
+            } as unknown as ReportAction;
+
+            const sorted = [createdAction, legacyExpenseUpdateAction, visibleAction];


Good catch — addressed in 8a4ce5b.

The fixture is now piped through ReportActionsUtils.getSortedReportActions(actions, true), which is exactly what getSortedReportActionsForDisplay does in production (descending by timestamp, CREATED last). The test now exercises the same ordering invariant the helper relies on, and the assertion compares against legacyExpenseUpdateAction.reportActionID so a future reorder can't silently regress it.

While verifying I also noticed the CREATED fixture had no message, which made isDeletedAction treat it as a legacy-deleted action (message ?? [] → empty array → isLegacyDeletedComment === true). That's not how production CREATED actions look, so I gave it a non-empty message to keep the fixture realistic.

chatgpt-codex-connector · 2026-05-11T13:53:33Z

Codex Review: Didn't find any major issues. Bravo.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

github-actions · 2026-05-11T13:53:46Z

🚧 @mountiny has triggered a test Expensify/App build. You can view the workflow run here.

mountiny · 2026-05-11T13:54:54Z

I can repro the issue in supportal for this user so I will test on the adhoc

github-actions · 2026-05-11T13:58:27Z

🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
Built from App PR #90201.

Android 🤖	iOS 🍎
⏩ SKIPPED ⏩	⏩ SKIPPED ⏩
The build for Android was skipped	The build for iOS was skipped

Web 🕸️
https://90201.pr-testing.expensify.com

👀 View the workflow run that generated this build 👀

Pipe the test fixture through `getSortedReportActions(actions, true)` to match the production sort order used by `getSortedReportActionsForDisplay` (descending by timestamp, CREATED last). This makes the test exercise the same ordering invariant `getFirstVisibleReportActionID` relies on, and prevents the array name `sorted` from being misleading. Also give the CREATED fixture a non-empty `message` so it is not treated as a legacy-deleted action by `isDeletedAction` (production CREATED actions always carry a message). The expected return value is now derived from the fixture variable so a future reorder cannot silently regress the assertion. Co-authored-by: Cursor <cursoragent@cursor.com>

…on-string-originalMessage

mjasikowski · 2026-05-11T16:18:34Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
- MacOS: Desktop
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified there are no new alerts related to the canBeMissing param for useOnyx
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
- I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
- I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
- I verified the JSDocs style guidelines (in STYLE.md) were followed
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
I verified any variables that can be defined as constants (ie. in CONST.ts or at the top of the file that uses the constant) are defined as such
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Android: mWeb Chrome

iOS: HybridApp

iOS: mWeb Safari

MacOS: Chrome / Safari

MacOS: Desktop

OSBotify · 2026-05-12T00:07:09Z

🚀 Deployed to staging by https://github.com/mountiny in version: 9.3.70-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	failure ❌
🍎 iOS 🍎	success ✅

Bundle Size Analysis (Sentry):

iOS

MelvinBot · 2026-05-12T00:08:21Z

No help site changes are required.

This PR is a purely internal bug fix — it adds a defensive type guard in ReportActionsUtils.ts to prevent a crash when legacy/OldDot report actions store a plain string in originalMessage instead of the expected object shape. There are no UI changes, no new user-facing features, and no changes to terminology, settings, or workflows that would need to be reflected in App/docs/articles.

mountiny requested review from a team as code owners May 11, 2026 13:46

melvin-bot Bot assigned mountiny May 11, 2026

melvin-bot Bot requested review from eVoloshchak and joekaufmanexpensify and removed request for a team May 11, 2026 13:47

mountiny requested a review from Copilot May 11, 2026 13:49

Copilot started reviewing on behalf of mountiny May 11, 2026 13:50 View session

Copilot AI reviewed May 11, 2026

View reviewed changes

mountiny and others added 2 commits May 11, 2026 15:59

Merge remote-tracking branch 'origin/main' into vit-fix-isDeletedActi…

4140e62

…on-string-originalMessage

mountiny removed the request for review from eVoloshchak May 11, 2026 14:47

mjasikowski approved these changes May 11, 2026

View reviewed changes

mountiny merged commit 260529f into main May 11, 2026
38 of 39 checks passed

mountiny deleted the vit-fix-isDeletedAction-string-originalMessage branch May 11, 2026 16:59

OSBotify mentioned this pull request May 11, 2026

Deploy Checklist: New Expensify 2026-05-11 #90263

Open

99 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[NO QA] Fix isDeletedAction crash when originalMessage is a string#90201

[NO QA] Fix isDeletedAction crash when originalMessage is a string#90201
mountiny merged 3 commits into
mainfrom
vit-fix-isDeletedAction-string-originalMessage

mountiny commented May 11, 2026

Uh oh!

melvin-bot Bot commented May 11, 2026

Uh oh!

mountiny commented May 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

mountiny May 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 11, 2026

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

mountiny commented May 11, 2026

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

mjasikowski commented May 11, 2026

Uh oh!

Uh oh!

OSBotify commented May 12, 2026

Uh oh!

MelvinBot commented May 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

mountiny commented May 11, 2026

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

melvin-bot Bot commented May 11, 2026

Uh oh!

mountiny commented May 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

mountiny May 11, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot commented May 11, 2026

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

mountiny commented May 11, 2026

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

mjasikowski commented May 11, 2026

Reviewer Checklist

Screenshots/Videos

Uh oh!

Uh oh!

OSBotify commented May 12, 2026

Uh oh!

MelvinBot commented May 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants