Chris Tate bbb37ae03b Read a spread's elements before an earlier argument converts ...

When the Math functions evaluate their arguments into temporaries before
converting (an earlier argument whose ToNumber can run valueOf), a spread
argument's array is now copied where it is evaluated. Before, the
temporary held the array itself and its elements were read after the
conversions, so a valueOf that changed the array changed the values
passed, while JavaScript reads a spread's elements during argument
evaluation.

2026-10-21 16:34:37 -05:00

..

corpus

Read a spread's elements before an earlier argument converts

2026-10-21 16:34:37 -05:00

coverage-fixtures

Iterate generators from Symbol.asyncIterator and check return() results in for await

2026-10-20 18:16:20 -05:00

deadstrip

…

diagnostics

Type empty arrays filled by later writes inside functions by their reads (#1632)

2026-10-21 04:23:15 -05:00

ffi

…

fixtures

Compile the hot-shots StatsD client over UDP (#1568)

2026-10-20 21:29:48 -05:00

harness

Sort by several keys without calling a chained comparator

2026-10-21 08:31:35 -05:00

library-mode

Add the cstring class to library profiles

2026-10-17 23:40:06 -05:00

test262

…

wasm-spec

Merge main

2026-10-20 17:56:44 -05:00