incorrect asset path replacement when the path is passed to `typeof` and using relative base

[sapphi-red]

Describe the bug

When the asset path is passed to typeof and using relative base, Vite replaces the value incorrectly due to the operator precedence.

For example,

if (typeof "VITE_ASSET_HASH" === "string") {
  console.log("is string")
}

is replaced with

if (typeof ""+new URL("./foo.png", import.meta.url)+"" === "string") {
  console.log("is string")
}

I guess this was a bug that existed before v8, but started to happen more because of the Rolldown's optimization.

Reproduction

https://stackblitz.com/edit/vitejs-vite-39hbtupj?file=src%2Fmain.js,vite.config.js&terminal=dev

Steps to reproduce

In the build output you can see

`string` + new URL(`hero-CLDdwZDr.png`,import.meta.url).href == `string` && console.log(n)

but this should be

typeof new URL(`hero-CLDdwZDr.png`,import.meta.url).href == `string` && console.log(n)

System Info

StackBlitz

  System:
    OS: Linux 5.0 undefined
    CPU: (8) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
    Memory: 0 Bytes / 0 Bytes
    Shell: 1.0 - /bin/jsh
  Binaries:
    Node: 22.22.0 - /usr/local/bin/node
    Yarn: 1.22.19 - /usr/local/bin/yarn
    npm: 10.8.2 - /usr/local/bin/npm
    pnpm: 8.15.6 - /usr/local/bin/pnpm
  npmPackages:
    vite: ^8.0.9 => 8.0.9

Used Package Manager

npm

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[mvanhorn]

Submitted #22330 - the fix expands the rewrite range to include the surrounding matching quotes and emits a parenthesized (""+runtime+"") so a leading typeof (or other unary operator) binds across the whole concatenated expression. Same change applied to the publicAssetUrlRE branch.

[sapphi-red]

Fixed in #22888, #22894.