Array destructuring rest element aliases the source array (writes leak into it; rc crash on push) #477

In const [first, ...rest] = src, rest shares src's data block instead of being a new array. Writing to rest changes src, and under rc a push onto rest crashes, because it reallocates a pointer into the middle of src's block.

function main() {
    const src: number[] = [1, 2, 3];
    const [first, ...rest] = src;
    rest[0] = 20;
    print("src[1] after rest[0]=20: ", src[1], " (2)");
    rest.push(4);
    print("rest: ", rest.length, " ", rest[2], " (3 4)");
    print("done.");
}

Expected: src[1] after rest[0]=20: 2, then rest: 3 4, then done.

Actual, tslang --emit=jit --no-default-lib (main 9a5cc05):

Cause: MLIRGenVariables.cpp (around lines 350 and 382) builds the rest element with ts.ArrayView, which is src's data pointer plus an offset, with a length. It is not a copy. TypeScript makes the rest element a new array.

Found while investigating #453. The array-as-reference design for #453 needs the rest element to be a copy anyway.

🤖 Generated with Claude Code