incorrect asset path replacement when the path is passed to typeof and using relative base #22304

Describe the bug

When the asset path is passed to typeof and using relative base, Vite replaces the value incorrectly due to the operator precedence.

For example,

if (typeof "VITE_ASSET_HASH" === "string") {
  console.log("is string")
}

is replaced with

if (typeof ""+new URL("./foo.png", import.meta.url)+"" === "string") {
  console.log("is string")
}

I guess this was a bug that existed before v8, but started to happen more because of the Rolldown's optimization.

Reproduction

https://stackblitz.com/edit/vitejs-vite-39hbtupj?file=src%2Fmain.js,vite.config.js&terminal=dev

Steps to reproduce

In the build output you can see

`string` + new URL(`hero-CLDdwZDr.png`,import.meta.url).href == `string` && console.log(n)

but this should be

typeof new URL(`hero-CLDdwZDr.png`,import.meta.url).href == `string` && console.log(n)

System Info

StackBlitz

  System:
    OS: Linux 5.0 undefined
    CPU: (8) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
    Memory: 0 Bytes / 0 Bytes
    Shell: 1.0 - /bin/jsh
  Binaries:
    Node: 22.22.0 - /usr/local/bin/node
    Yarn: 1.22.19 - /usr/local/bin/yarn
    npm: 10.8.2 - /usr/local/bin/npm
    pnpm: 8.15.6 - /usr/local/bin/pnpm
  npmPackages:
    vite: ^8.0.9 => 8.0.9

Used Package Manager

npm

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.