Chris Tate f8b1f9ffc3 Keep a spread tuple alive until all its fields are packed into the rest ...

A spread tuple's first field carries the statements that evaluate the
tuple into a hidden local, and its later fields read that local. When
lowerArraySpreadItems stored the first field as one item's expression,
the local's frame ended with that store, so a tuple returned by a call
was released before its later fields were read (a use-after-free under
SCRIPTC_SAN=1). The field's statements now join the packing sequence at
the item's position, whose frame lasts until every item is stored.

2026-10-25 05:02:40 -05:00

..

corpus

Keep a spread tuple alive until all its fields are packed into the rest

2026-10-25 05:02:40 -05:00

coverage-fixtures

Compile more npm and CommonJS JavaScript dependencies statically (#2122)

2026-10-24 18:30:56 -05:00

deadstrip

…

diagnostics

Compile more npm and CommonJS JavaScript dependencies statically (#2122)

2026-10-24 18:30:56 -05:00

ffi

…

fixtures

Check with a tsc-ts server shared by later builds (opt-in) (#2153)

2026-10-24 19:12:05 -05:00

harness

Merge main

2026-10-24 21:05:55 -05:00

library-mode

Cache untyped property access in programs that declare classes (reland)

2026-10-24 08:22:30 -05:00

node-parallel

Compare termination signals and resolve the Node checkout path in the test/parallel runner

2026-10-24 16:00:06 -05:00

test262

Convert compareArray's message only when the arrays differ

2026-10-24 16:16:23 -05:00

wasm-spec

…