From 35da60b5a9cd2758e871a9e260eade327c64e736 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hu=C3=A1ng=20J=C3=B9nli=C3=A0ng?= Date: Thu, 14 Jul 2022 15:45:55 -0400 Subject: [PATCH 1/5] fix: skip flattening spread object with __proto__ --- .../src/create-plugin.ts | 11 ++++++++- .../react-automatic/flattens-spread/input.js | 4 ++++ .../flattens-spread/output.mjs | 10 ++++++++ .../handle-spread-with-proto/input.js | 7 ++++++ .../handle-spread-with-proto/output.mjs | 24 +++++++++++++++++++ .../fixtures/react/flattens-spread/input.js | 4 ++++ .../fixtures/react/flattens-spread/output.js | 10 ++++++++ .../react/handle-spread-with-proto/input.js | 7 ++++++ .../react/handle-spread-with-proto/output.js | 18 ++++++++++++++ 9 files changed, 94 insertions(+), 1 deletion(-) create mode 100644 packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/input.js create mode 100644 packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/output.mjs create mode 100644 packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/input.js create mode 100644 packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js diff --git a/packages/babel-plugin-transform-react-jsx/src/create-plugin.ts b/packages/babel-plugin-transform-react-jsx/src/create-plugin.ts index 3e3a93963030..352507157f21 100644 --- a/packages/babel-plugin-transform-react-jsx/src/create-plugin.ts +++ b/packages/babel-plugin-transform-react-jsx/src/create-plugin.ts @@ -39,6 +39,15 @@ const get = (pass: PluginPass, name: string) => const set = (pass: PluginPass, name: string, v: any) => pass.set(`@babel/plugin-react-jsx/${name}`, v); +function hasProto(node: t.ObjectExpression) { + return node.properties.some( + value => + t.isObjectProperty(value, { computed: false }) && + (t.isIdentifier(value.key, { name: "__proto__" }) || + t.isStringLiteral(value.key, { value: "__proto__" })), + ); +} + export interface Options { filter?: (node: t.Node, pass: PluginPass) => boolean; importSource?: string; @@ -422,7 +431,7 @@ You can set \`throwIfNamespace: false\` to bypass this warning.`, if (t.isJSXSpreadAttribute(attribute.node)) { const arg = attribute.node.argument; // Collect properties into props array if spreading object expression - if (t.isObjectExpression(arg)) { + if (t.isObjectExpression(arg) && !hasProto(arg)) { array.push(...arg.properties); } else { array.push(t.spreadElement(arg)); diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/input.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/input.js index 7cf92a69c605..90583d9cae87 100644 --- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/input.js +++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/input.js @@ -5,3 +5,7 @@ ;
{items}
; + +
;
+
+;
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/output.mjs b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/output.mjs
index 738dcc4e9e95..1af3a72670f5 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/output.mjs
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/output.mjs
@@ -22,3 +22,13 @@ _jsx("blockquote", {
   cite,
   children: items
 });
+
+/*#__PURE__*/
+_jsx("pre", {
+  ["__proto__"]: null
+});
+
+/*#__PURE__*/
+_jsx("code", {
+  [__proto__]: null
+});
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/input.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/input.js
new file mode 100644
index 000000000000..9c912e5b5dac
--- /dev/null
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/input.js
@@ -0,0 +1,7 @@
+var __proto__ = null;
+
+
text
;
+
+
{contents}
;
+
+;
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/output.mjs b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/output.mjs
new file mode 100644
index 000000000000..fe59e902ea16
--- /dev/null
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/output.mjs
@@ -0,0 +1,24 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+var __proto__ = null;
+
+/*#__PURE__*/
+_jsx("p", { ...{
+    __proto__: null
+  },
+  children: "text"
+});
+
+/*#__PURE__*/
+_jsx("div", { ...{
+    "__proto__": null
+  },
+  children: contents
+});
+
+/*#__PURE__*/
+_jsx("img", {
+  alt: "",
+  ...{
+    __proto__
+  }
+});
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/input.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/input.js
index 7cf92a69c605..90583d9cae87 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/input.js
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/input.js
@@ -5,3 +5,7 @@
 ;
 
 
{items}
;
+
+
;
+
+;
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/output.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/output.js
index 25b234ea3b58..5802d5a62a99 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/output.js
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/output.js
@@ -15,3 +15,13 @@ React.createElement("img", {
 React.createElement("blockquote", {
   cite
 }, items);
+
+/*#__PURE__*/
+React.createElement("pre", {
+  ["__proto__"]: null
+});
+
+/*#__PURE__*/
+React.createElement("code", {
+  [__proto__]: null
+});
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/input.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/input.js
new file mode 100644
index 000000000000..9c912e5b5dac
--- /dev/null
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/input.js
@@ -0,0 +1,7 @@
+var __proto__ = null;
+
+
text
;
+
+
{contents}
;
+
+;
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js
new file mode 100644
index 000000000000..456dad6b23ff
--- /dev/null
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js
@@ -0,0 +1,18 @@
+var __proto__ = null;
+
+/*#__PURE__*/
+React.createElement("p", {
+  __proto__: null
+}, "text");
+
+/*#__PURE__*/
+React.createElement("div", {
+  "__proto__": null
+}, contents);
+
+/*#__PURE__*/
+React.createElement("img", babelHelpers.extends({
+  alt: ""
+}, {
+  __proto__
+}));

From 9e3b5c8ae48ef72c9a17b9d2bc91d6a223855e02 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hu=C3=A1ng=20J=C3=B9nli=C3=A0ng?= 
Date: Thu, 14 Jul 2022 16:19:46 -0400
Subject: [PATCH 2/5] update Babel 8 testcases

---
 .../handle-spread-with-proto-babel-7/input.js  |  7 +++++++
 .../options.json                               |  3 +++
 .../handle-spread-with-proto-babel-7/output.js | 18 ++++++++++++++++++
 .../handle-spread-with-proto/options.json      |  3 +++
 .../react/handle-spread-with-proto/output.js   | 11 ++++++-----
 5 files changed, 37 insertions(+), 5 deletions(-)
 create mode 100644 packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/input.js
 create mode 100644 packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/options.json
 create mode 100644 packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/output.js
 create mode 100644 packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/options.json

diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/input.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/input.js
new file mode 100644
index 000000000000..9c912e5b5dac
--- /dev/null
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/input.js
@@ -0,0 +1,7 @@
+var __proto__ = null;
+
+
text
;
+
+
{contents}
;
+
+;
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/options.json b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/options.json
new file mode 100644
index 000000000000..29a3f0e84167
--- /dev/null
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/options.json
@@ -0,0 +1,3 @@
+{
+  "BABEL_8_BREAKING": false
+}
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/output.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/output.js
new file mode 100644
index 000000000000..456dad6b23ff
--- /dev/null
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/output.js
@@ -0,0 +1,18 @@
+var __proto__ = null;
+
+/*#__PURE__*/
+React.createElement("p", {
+  __proto__: null
+}, "text");
+
+/*#__PURE__*/
+React.createElement("div", {
+  "__proto__": null
+}, contents);
+
+/*#__PURE__*/
+React.createElement("img", babelHelpers.extends({
+  alt: ""
+}, {
+  __proto__
+}));
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/options.json b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/options.json
new file mode 100644
index 000000000000..cbf6d1595427
--- /dev/null
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/options.json
@@ -0,0 +1,3 @@
+{
+  "BABEL_8_BREAKING": true
+}
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js
index 456dad6b23ff..8cbd2578a629 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js
@@ -11,8 +11,9 @@ React.createElement("div", {
 }, contents);
 
 /*#__PURE__*/
-React.createElement("img", babelHelpers.extends({
-  alt: ""
-}, {
-  __proto__
-}));
+React.createElement("img", {
+  alt: "",
+  ...{
+    __proto__
+  }
+});

From f88943eb9ba80d1a23fe6e55b5ad53837243ebe2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hu=C3=A1ng=20J=C3=B9nli=C3=A0ng?= 
Date: Fri, 15 Jul 2022 11:30:40 -0400
Subject: [PATCH 3/5] fix single spread element optimization

---
 .../src/create-plugin.ts                      | 19 +++++++++++++++++--
 .../output.js                                 |  8 ++++----
 .../react/handle-spread-with-proto/output.js  | 10 ++++++----
 .../react/proto-in-jsx-attribute/input.js     |  1 +
 .../react/proto-in-jsx-attribute/output.js    |  5 +++++
 5 files changed, 33 insertions(+), 10 deletions(-)
 create mode 100644 packages/babel-plugin-transform-react-jsx/test/fixtures/react/proto-in-jsx-attribute/input.js
 create mode 100644 packages/babel-plugin-transform-react-jsx/test/fixtures/react/proto-in-jsx-attribute/output.js

diff --git a/packages/babel-plugin-transform-react-jsx/src/create-plugin.ts b/packages/babel-plugin-transform-react-jsx/src/create-plugin.ts
index 352507157f21..6562844486df 100644
--- a/packages/babel-plugin-transform-react-jsx/src/create-plugin.ts
+++ b/packages/babel-plugin-transform-react-jsx/src/create-plugin.ts
@@ -727,7 +727,17 @@ You can set \`throwIfNamespace: false\` to bypass this warning.`,
           }
 
           if (objs.length === 1) {
-            return objs[0];
+            if (
+              !(
+                t.isSpreadElement(props[0]) &&
+                // If an object expression is spread element's argument
+                // it is very likely to contain __proto__ and we should stop
+                // optimizing spread element
+                t.isObjectExpression(props[0].argument)
+              )
+            ) {
+              return objs[0];
+            }
           }
 
           // looks like we have multiple objects
@@ -764,7 +774,12 @@ You can set \`throwIfNamespace: false\` to bypass this warning.`,
         accumulateAttribute(props, attr);
       }
 
-      return props.length === 1 && t.isSpreadElement(props[0])
+      return props.length === 1 &&
+        t.isSpreadElement(props[0]) &&
+        // If an object expression is spread element's argument
+        // it is very likely to contain __proto__ and we should stop
+        // optimizing spread element
+        !t.isObjectExpression(props[0].argument)
         ? props[0].argument
         : props.length > 0
         ? t.objectExpression(props)
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/output.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/output.js
index 456dad6b23ff..21ff33f71bf5 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/output.js
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/output.js
@@ -1,14 +1,14 @@
 var __proto__ = null;
 
 /*#__PURE__*/
-React.createElement("p", {
+React.createElement("p", babelHelpers.extends({
   __proto__: null
-}, "text");
+}), "text");
 
 /*#__PURE__*/
-React.createElement("div", {
+React.createElement("div", babelHelpers.extends({
   "__proto__": null
-}, contents);
+}), contents);
 
 /*#__PURE__*/
 React.createElement("img", babelHelpers.extends({
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js
index 8cbd2578a629..bd4035962194 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js
@@ -1,13 +1,15 @@
 var __proto__ = null;
 
 /*#__PURE__*/
-React.createElement("p", {
-  __proto__: null
+React.createElement("p", { ...{
+    __proto__: null
+  }
 }, "text");
 
 /*#__PURE__*/
-React.createElement("div", {
-  "__proto__": null
+React.createElement("div", { ...{
+    "__proto__": null
+  }
 }, contents);
 
 /*#__PURE__*/
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/proto-in-jsx-attribute/input.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/proto-in-jsx-attribute/input.js
new file mode 100644
index 000000000000..15228285e30e
--- /dev/null
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/proto-in-jsx-attribute/input.js
@@ -0,0 +1 @@
+
text
;
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/proto-in-jsx-attribute/output.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/proto-in-jsx-attribute/output.js
new file mode 100644
index 000000000000..a975dc74f39e
--- /dev/null
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/proto-in-jsx-attribute/output.js
@@ -0,0 +1,5 @@
+/*#__PURE__*/
+React.createElement("p", {
+  __proto__: null,
+  class: "bar"
+}, "text");

From 04d88f27c6efedbc4aab796c92f0d671dfa81dd4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hu=C3=A1ng=20J=C3=B9nli=C3=A0ng?= 
Date: Sat, 16 Jul 2022 10:22:58 -0400
Subject: [PATCH 4/5] Update
 packages/babel-plugin-transform-react-jsx/src/create-plugin.ts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Nicolò Ribaudo 
---
 packages/babel-plugin-transform-react-jsx/src/create-plugin.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/babel-plugin-transform-react-jsx/src/create-plugin.ts b/packages/babel-plugin-transform-react-jsx/src/create-plugin.ts
index 6562844486df..1b23ae5c769a 100644
--- a/packages/babel-plugin-transform-react-jsx/src/create-plugin.ts
+++ b/packages/babel-plugin-transform-react-jsx/src/create-plugin.ts
@@ -42,7 +42,7 @@ const set = (pass: PluginPass, name: string, v: any) =>
 function hasProto(node: t.ObjectExpression) {
   return node.properties.some(
     value =>
-      t.isObjectProperty(value, { computed: false }) &&
+      t.isObjectProperty(value, { computed: false, shorthand: false }) &&
       (t.isIdentifier(value.key, { name: "__proto__" }) ||
         t.isStringLiteral(value.key, { value: "__proto__" })),
   );

From da9ecdafd210fa847eb1e4ef75be46f1460e3a77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hu=C3=A1ng=20J=C3=B9nli=C3=A0ng?= 
Date: Mon, 18 Jul 2022 09:23:06 -0400
Subject: [PATCH 5/5] update test fixtures

---
 .../fixtures/react-automatic/flattens-spread/input.js  |  2 +-
 .../react-automatic/flattens-spread/output.mjs         |  3 ++-
 .../react-automatic/handle-spread-with-proto/input.js  |  4 ----
 .../handle-spread-with-proto/output.mjs                |  9 ---------
 .../test/fixtures/react/flattens-spread/input.js       |  2 +-
 .../test/fixtures/react/flattens-spread/output.js      |  3 ++-
 .../react/handle-spread-with-proto-babel-7/input.js    |  4 ----
 .../react/handle-spread-with-proto-babel-7/output.js   |  9 ---------
 .../fixtures/react/handle-spread-with-proto/input.js   |  4 ----
 .../fixtures/react/handle-spread-with-proto/output.js  | 10 ----------
 10 files changed, 6 insertions(+), 44 deletions(-)

diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/input.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/input.js
index 90583d9cae87..24d4257e21b4 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/input.js
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/input.js
@@ -2,7 +2,7 @@
 
 
{contents}
;
 
-;
+;
 
 
{items}
;
 
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/output.mjs b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/output.mjs
index 1af3a72670f5..1612ddc01cf0 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/output.mjs
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/output.mjs
@@ -14,7 +14,8 @@ _jsx("div", { ...props,
 _jsx("img", {
   alt: "",
   src,
-  title
+  title,
+  __proto__
 });
 
 /*#__PURE__*/
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/input.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/input.js
index 9c912e5b5dac..4d745e96c31f 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/input.js
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/input.js
@@ -1,7 +1,3 @@
-var __proto__ = null;
-
 
text
;
 
 
{contents}
;
-
-;
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/output.mjs b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/output.mjs
index fe59e902ea16..31d60b3878f3 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/output.mjs
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/output.mjs
@@ -1,5 +1,4 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-var __proto__ = null;
 
 /*#__PURE__*/
 _jsx("p", { ...{
@@ -14,11 +13,3 @@ _jsx("div", { ...{
   },
   children: contents
 });
-
-/*#__PURE__*/
-_jsx("img", {
-  alt: "",
-  ...{
-    __proto__
-  }
-});
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/input.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/input.js
index 90583d9cae87..24d4257e21b4 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/input.js
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/input.js
@@ -2,7 +2,7 @@
 
 
{contents}
;
 
-;
+;
 
 
{items}
;
 
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/output.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/output.js
index 5802d5a62a99..59b3fe96530b 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/output.js
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/output.js
@@ -8,7 +8,8 @@ React.createElement("div", props, contents);
 React.createElement("img", {
   alt: "",
   src,
-  title
+  title,
+  __proto__
 });
 
 /*#__PURE__*/
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/input.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/input.js
index 9c912e5b5dac..4d745e96c31f 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/input.js
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/input.js
@@ -1,7 +1,3 @@
-var __proto__ = null;
-
 
text
;
 
 
{contents}
;
-
-;
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/output.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/output.js
index 21ff33f71bf5..3e1b64acf38a 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/output.js
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto-babel-7/output.js
@@ -1,5 +1,3 @@
-var __proto__ = null;
-
 /*#__PURE__*/
 React.createElement("p", babelHelpers.extends({
   __proto__: null
@@ -9,10 +7,3 @@ React.createElement("p", babelHelpers.extends({
 React.createElement("div", babelHelpers.extends({
   "__proto__": null
 }), contents);
-
-/*#__PURE__*/
-React.createElement("img", babelHelpers.extends({
-  alt: ""
-}, {
-  __proto__
-}));
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/input.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/input.js
index 9c912e5b5dac..4d745e96c31f 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/input.js
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/input.js
@@ -1,7 +1,3 @@
-var __proto__ = null;
-
 
text
;
 
 
{contents}
;
-
-;
diff --git a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js
index bd4035962194..98dcdecf6585 100644
--- a/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js
+++ b/packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js
@@ -1,5 +1,3 @@
-var __proto__ = null;
-
 /*#__PURE__*/
 React.createElement("p", { ...{
     __proto__: null
@@ -11,11 +9,3 @@ React.createElement("div", { ...{
     "__proto__": null
   }
 }, contents);
-
-/*#__PURE__*/
-React.createElement("img", {
-  alt: "",
-  ...{
-    __proto__
-  }
-});