JS: Add spread step when bactracking in API graphs

javascript/ql/src/semmle/javascript/ApiGraphs.qll

@@ -750,6 +750,18 @@ module API {
         )
       )
       or
+      exists(ObjectExpr obj |
+        obj = trackDefNode(nd, t.continue()).asExpr() and
+        result =
+          obj.getAProperty()
+              .(SpreadProperty)
+              .getInit()
+              .(SpreadElement)
+              .getOperand()
+              .flow()
+              .getALocalSource()
+      )
+      or
       t = defStep(nd, result)
     }
 

javascript/ql/test/ApiGraphs/spread/VerifyAssertions.ql

@@ -0,0 +1 @@
+import ApiGraphs.VerifyAssertions

javascript/ql/test/ApiGraphs/spread/package.json

@@ -0,0 +1,6 @@
+{
+    "name": "spread",
+    "dependencies": {
+        "something": "*"
+    }
+}

javascript/ql/test/ApiGraphs/spread/tst.js

@@ -0,0 +1,11 @@
+const lib = require('something');
+
+function f() {
+    return {
+        x: new Object() /* def (member x (parameter 0 (member m1 (member exports (module something))))) */
+    }
+}
+
+lib.m1({
+    ...f()
+})