Repository navigation
String spread produces raw NaN-boxed floats instead of characters #16
Description
Description
[..."hello"] should produce ["h", "e", "l", "l", "o"] but instead produces an array of raw NaN-boxed float values (the STRING_TAG bits interpreted as f64). chars[0] returns a huge number and typeof chars[0] is "number".
Repro
const chars = [..."hello"];
console.log(chars.join(",")); // Expected: h,e,l,l,o
console.log(typeof chars[0]); // Expected: string, Actual: numberRoot cause
The spread operator on a string likely produces NaN-boxed string pointers that are stored in the array as f64, but the array element type isn't tracked as string — so IndexGet returns the raw bits as a number instead of unboxing through the string path.
Confirmed pre-existing (present before v0.5.2 optimizations). Affects test_edge_rest_spread_defaults line 42.
Activity
fix: string spread `[..."hello"]` now produces character array (closes …
proggeramlug commentedon Apr 13, 2026
Fixed in 8bfdb65. String spread now calls js_string_to_char_array to split the string into individual character strings instead of passing the NaN-boxed pointer to js_array_concat. test_edge_rest_spread_defaults is now a MATCH.
fix: string spread `[..."hello"]` now produces character array (closes …
fix(gc): the aarch64 prologue decoder was blind to two real shapes (#…
fix(gc): the aarch64 fast stack-map walker misread every SVE-shaped p…