Skip to content

deps: V8: cherry-pick fd75c97d3f56

Rodrigo Muino Tomonari requested to merge github/fork/targos/fix-v8-spread-bug into master

Fixes interpretation of the following:

null?.(...[], 1)

In Node.js <= 16.0.0, it incorrectly throws a TypeError.

Original commit message:

[interpreter] Apply Reflect.apply transform in BytecodeGenerator

Calls with a spread expression in a non-final position get transformed
to calls to Reflect.apply. This transformation is currently done in
the parser, which does not compose well with other features (e.g.
direct eval checking, optional chaining).

Do this transform in the BytecodeGenerator instead.

Bug: v8:11573, v8:11558, v8:5690
Change-Id: I56c90a2036fe5b43e0897c57766f666bf72bc3a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2765783
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73534}

Refs: https://github.com/v8/v8/commit/fd75c97d3f56f0e4b8f2842c08b0f8d1c47bed00

Merge request reports