fix push array on itself

qbe_emit.cm

@@ -517,13 +517,19 @@ ${alloc_tail("%r")}
 ${alloc_tail("%r")}
 }`
 
-  // push(ctx, fp, arr_slot, val_slot) — no dest write
+  // push(ctx, fp, arr_slot, val_slot) — write back arr in case GC moved it
   h[] = `export function l $__push_ss(l %ctx, l %fp, l %arr_slot, l %val_slot) {
 @entry
 ${sr("a", "%arr_slot")}
 ${sr("b", "%val_slot")}
-  call $cell_rt_push(l %ctx, l %a, l %b)
-${alloc_tail_nw()}
+  %r =l call $cell_rt_push(l %ctx, l %a, l %b)
+  %fp2 =l call $cell_rt_refresh_fp_checked(l %ctx)
+  jnz %fp2, @ok, @exc
+@ok
+${sw("w", "%fp2", "%arr_slot", "%r")}
+  ret %fp2
+@exc
+  ret 0
 }`
 
   // pop(ctx, fp, dest, arr_slot)

source/qbe_helpers.c

@@ -573,8 +573,9 @@ JSValue cell_rt_goinvoke(JSContext *ctx, JSValue frame_val) {
 
 /* --- Array push/pop --- */
 
-void cell_rt_push(JSContext *ctx, JSValue arr, JSValue val) {
+JSValue cell_rt_push(JSContext *ctx, JSValue arr, JSValue val) {
   JS_ArrayPush(ctx, &arr, val);
+  return arr;
 }
 
 JSValue cell_rt_pop(JSContext *ctx, JSValue arr) {