Spread elements in array literals and call arguments are iterated after later elements are evaluated #5316

Spread elements in array literals and function call argument lists are not iterated until after subsequent elements or arguments in the list have been evaluated. As a result, side effects in later expressions mutate the iterable before the spread runs.

Per ECMA-262 ArrayAccumulation and ArgumentListEvaluation, a SpreadElement must be evaluated and iterated to completion before evaluating the next element or argument in the list.

JerryScript revision

v3.0.0, b706935 (master)

Build platform

macOS 26.3 (Darwin 25.3.0 arm64)

Build steps

tools/build.py --clean --debug

Test case

var a = [1];
print(JSON.stringify([...a, a.push(2)]));

var b = [1];
print(JSON.stringify(Array(...b, b.push(2))));

Execution steps

build/bin/jerry testcase.js

Output

[1,2,2]
[1,2,2]

Expected behavior

[1,2]
[1,2]

Credit: https://ucsbplse.github.io/