push/unshift/splice take spread arguments; push takes more than one item

[ASDAlexander77]

Two array-builtin bugs, one of which hid the other.

1. push with more than one item failed to verify.

let m: number[] = [];
m.push(1, 2);   // error: 'ts.ArrayPush' op failed to verify that array element type match all items types

ArrayPush checked its items with RangedTypesMatchWith against TypeRange(elementType), a one-type range. Only a single item can match it. The trait is replaced with a verifier (TypeScriptOps.cpp) that checks every item against the element type. unshift and splice never had the trait, which is why splice(1, 1, 10, 20, 30) worked.

2. Spread arguments to push, unshift and splice. A builtin takes one operand per item, and a spread's length is known only at run time. a.push(...xs) handed xs itself over as one item, so it hit the verifier above.

The new mlirGenArrayInsertWithSpread (MLIRGenAccessCall.cpp) runs before operands are generated, and only when a spread argument is present:

• Every item argument, spread or not, becomes one array literal, which already expands spreads at run time.
• Its elements are then inserted one at a time through the same builtin without a spread, so the element casts and the -mm=rc retains stay the builtin's.
• push reuses mlirGenAppendArrayByEachElement.
• unshift and splice insert at a position. For splice, the delete runs first, and the position is the start as JavaScript normalizes it: a negative start counts from the end, and the result is clamped to the array.
• The result is the new length, as the builtins already return.
• A spread in splice's start or delete-count position is a clear error.

Test: 00array_spread_args.ts, registered for compile, jit and the corpus. It covers:

• push with two items;
• push, unshift and splice with a spread alone and mixed with plain items;
• an empty spread, and a parameter spread;
• negative, past-the-end and before-the-start splice positions;
• s32[] spread into number[], and strings.

It fails on main, and it runs clean under -mm=rc --verify-ownership.

Results: the suite passes locally, 3017/3017.

Found along the way, not changed here (both also fail on main):

• assert(cond, what + ": x"): an assert message built at run time fails with "operation's operand is unlinked", or "'ts.Retain' op using value defined outside the region". The test uses constant messages.
• Under JIT with gc only, a function that builds a string with s += v + "," loses its first append when it is called after certain array-literal spreads. AOT and -mm=rc are correct, and the Sep 11 build is too.

🤖 Generated with Claude Code