[compiler] Patch array and argument spread mutability

[mofeiZ]

Array and argument spreads may mutate stateful iterables. Spread sites should have ConditionallyMutate effects (e.g. mutate if the ValueKind is mutable, otherwise read).

See

• ecma spec (13.2.4.1 Runtime Semantics: ArrayAccumulation. SpreadElement : ... AssignmentExpression).
• ecma spec 13.3.8.1 Runtime Semantics: ArgumentListEvaluation

Note that

• Object and JSX Attribute spreads do not evaluate iterables (srcs mozilla, ecma)
• An ideal mutability inference system could model known collections (i.e. Arrays or Sets) as a "mutated collection of non-mutable objects" (see todo-granular-iterator-semantics), but this is not what we do today. As such, an array / argument spread will always extend the range of built-in arrays, sets, etc
• Due to HIR limitations, call expressions with argument spreads may cause unnecessary bailouts and/or scope merging when we know the call itself has freeze, capture, or read semantics (e.g. useHook(...mutableValue))
  We can deal with this by rewriting these call instructions to (1) create an intermediate array to consume the iterator and (2) capture and spread the array at the callsite

---

Stack created with Sapling. Best reviewed with ReviewStack.

• [compiler][optim] Add shape for Array.from #32522
• -> [compiler] Patch array and argument spread mutability #32521
• [compiler] Repro for object spread and Array.from with mutable iterators #32520

[mofeiZ]

This is the hook call bailout case. This new bailout is good (better correctness, as we were previously memoizing the items.values() iterable)

Ideally we can rewrite this to 1) create an intermediate array to consume the iterable and (2) capture and spread the array at the callsite.

const items = makeArray(0, 1, 2, null, 4, false, 6);
const tmp = [...items.values()]; // this spread has conditionallyMutate effects
return useIdentity([...tmp]); // but this spread has freeze effects