[ASDAlexander77]

h.push(() => 1) into a (() => number)[] crashed the compiler (0xC0000005) with no message. () => 1 is a () => s32, so the cast to the element type fails. push, unshift and splice then passed the cast's null result to the op's builder. Now the cast's own error stops them, the same message an assignment gives:

error: can't assign '() => s32' to '() => number': return type 's32' is not 'number'. ...

The builtins in MLIRCodeLogic.h that used a castFn result without checking it now check it too:

• push, unshift, splice and view, through one castEach helper;
• splice's start and delete count;
• sprintf's buffer size and format, and assert's condition;
• parseInt, parseFloat and isNaN, which now return ValueOrLogicalResult. parseInt(() => 1) and isNaN(() => 1) crashed on main too.
• __switchstate's state, and a constant array converted to an array for an array method.

Tests:

• builtin-cast/*.ts: expect the error for push, unshift, splice, a function pushed into a string[], parseInt and isNaN. Each one crashes on main.
• 00array_insert_functions.ts: functions whose type matches the element type still go in through push, unshift and splice, and each calls correctly.

Gate	Result
Windows full suite (Release)	3816/3816
Linux (WSL) full suite	3801/3801
DefaultLib suite, release + debug, compile + JIT	gc 159/159; rc, none 158/159 (weakref_basic is gc-only, as on main)
own corpus	no flips (459/617). The new runtime test is an own error by design: one captured n in several escaping closures.

Closes #438

🤖 Generated with Claude Code