fix push array on itself

qbe_emit.cm

@@ -517,13 +517,19 @@ ${alloc_tail("%r")}
 ${alloc_tail("%r")}
 }`
 
-  // push(ctx, fp, arr_slot, val_slot) — no dest write
+  // push(ctx, fp, arr_slot, val_slot) — write back arr in case GC moved it
   h[] = `export function l $__push_ss(l %ctx, l %fp, l %arr_slot, l %val_slot) {
 @entry
 ${sr("a", "%arr_slot")}
 ${sr("b", "%val_slot")}
-  call $cell_rt_push(l %ctx, l %a, l %b)
-${alloc_tail_nw()}
+  %r =l call $cell_rt_push(l %ctx, l %a, l %b)
+  %fp2 =l call $cell_rt_refresh_fp_checked(l %ctx)
+  jnz %fp2, @ok, @exc
+@ok
+${sw("w", "%fp2", "%arr_slot", "%r")}
+  ret %fp2
+@exc
+  ret 0
 }`
 
   // pop(ctx, fp, dest, arr_slot)