Leave a forwarded vararg placeholder on the packed path

A vararg constructor is reached through a generated new_C wrapper that passes
its own vararg parameter to construct_C. When a call above the bound keeps
that wrapper as the retained original, its body still holds the forwarding
call, and the placeholder is one node standing for however many arguments the
caller passed. Counting nodes turned it into an arity, so construct_C_1 was
generated and the call rewritten to it: every argument after the first was
dropped and the constructor ran on one value.

Node count is only an arity when no node is a placeholder, so calls that
forward one are now left alone. This is Lua-only in effect. The forwarding
call survives in the body of a vararg original, and a copy has its
placeholder expanded into real parameters long before anything counts them
again, so only originals match - which Jass removes and Lua retains.

Both the generation and the rewrite loop consult the same predicate. Skipping
generation alone would not have been enough: another call can produce a copy
at the same node count, and the rewrite would then redirect the forwarding
call to it regardless.

The existing above-the-bound test used a plain function, which has no wrapper
and so never forwards. The new test uses a constructor and fails on the
constructed value before this change.

Author: Frotty

de.peeeq.wurstscript/src/main/java/de/peeeq/wurstscript/translation/imtranslation/VarargEliminator.java

@@ -58,7 +58,7 @@ public void run() {
         while (generated) {
             generated = false;
             for (ImFunctionCall c : collectVarargCalls()) {
-                if (c.getFunc().hasFlag(IS_VARARG) && shouldSpecialise(c)
+                if (c.getFunc().hasFlag(IS_VARARG) && shouldSpecialise(c) && !forwardsAVarargParameter(c.getArguments())
                     && !varargFuncs.contains(c.getFunc(), c.getArguments().size())) {
                     generateVarargFunc(c);
                     generated = true;
@@ -72,7 +72,7 @@ public void run() {
                 for (ImMethodCall c : collectMonomorphicVarargMethodCalls()) {
                     ImFunction implementation = c.getMethod().getImplementation();
                     List<ImExpr> arguments = receiverAndArguments(c);
-                    if (shouldSpecialise(arguments)
+                    if (shouldSpecialise(arguments) && !forwardsAVarargParameter(arguments)
                         && !varargFuncs.contains(implementation, arguments.size())) {
                         generateVarargFunc(implementation, arguments, c);
                         generated = true;
@@ -90,21 +90,56 @@ public void run() {
         // (need to collect vararg calls again, because first phase can create copies of calls)
         for (ImFunctionCall call : collectVarargCalls()) {
             ImFunction newFunc = varargFuncs.get(call.getFunc(), call.getArguments().size());
-            if (newFunc != null) {
+            if (newFunc != null && !forwardsAVarargParameter(call.getArguments())) {
                 redirectCall(call, newFunc);
             }
         }
         if (luaTarget) {
             for (ImMethodCall call : collectMonomorphicVarargMethodCalls()) {
                 ImFunction implementation = call.getMethod().getImplementation();
                 ImFunction newFunc = varargFuncs.get(implementation, 1 + call.getArguments().size());
-                if (newFunc != null) {
+                if (newFunc != null && !forwardsAVarargParameter(receiverAndArguments(call))) {
                     redirectMethodCall(call, newFunc);
                 }
             }
         }
     }
 
+
+    /**
+     * Whether a call passes a vararg placeholder straight through, which is what the generated
+     * `new_C` wrapper of a vararg constructor does with its own parameter. The placeholder is a
+     * single node standing for however many arguments the caller actually passed, so the call's node
+     * count is not an arity: specialising by it would produce a fixed-arity callee and drop every
+     * argument after the first.
+     *
+     * <p>Only reachable on Lua. The forwarding call lives in the body of a vararg original, and a
+     * copy has its placeholder expanded into real parameters before anything looks at it again, so
+     * this matches only originals - which Jass removes and Lua retains.
+     *
+     * <p>Both the generation and the rewrite loop consult this. Skipping generation alone would not
+     * be enough: another call could have produced a copy at the same node count, and the rewrite
+     * would then redirect the forwarding call to it.
+     */
+    private static boolean forwardsAVarargParameter(List<ImExpr> arguments) {
+        for (ImExpr argument : arguments) {
+            if (argument instanceof ImVarAccess access && isVarargPlaceholder(access.getVar())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /** The trailing parameter of a function still marked vararg, as opposed to a local or a copy's. */
+    private static boolean isVarargPlaceholder(ImVar variable) {
+        if (variable.getParent() == null
+            || !(variable.getParent().getParent() instanceof ImFunction function)
+            || !function.hasFlag(IS_VARARG)) {
+            return false;
+        }
+        List<ImVar> parameters = function.getParameters();
+        return !parameters.isEmpty() && parameters.get(parameters.size() - 1) == variable;
+    }
     /** A method call which can only ever reach one implementation, and that implementation is vararg. */
     private Collection<ImMethodCall> collectMonomorphicVarargMethodCalls() {
         final Collection<ImMethodCall> calls = new ArrayList<>();

de.peeeq.wurstscript/src/test/java/tests/wurstscript/tests/LuaBackendAuditTests.java

@@ -2096,6 +2096,39 @@ public void varargCallAboveTheLuaArityBoundKeepsThePackedPath() throws IOExcepti
             compiled.contains("table.pack"));
     }
 
+    /**
+     * A vararg constructor is reached through a compiler-generated `new_C` wrapper which forwards its
+     * vararg placeholder to `construct_C`. When a call above the bound keeps that wrapper as the
+     * retained original, its body still holds the forwarding call, and the placeholder is one node
+     * standing for however many arguments the caller passed. Specialising by node count would rewrite
+     * it to a fixed-arity constructor and silently drop every argument after the first.
+     */
+    @Test
+    public void varargConstructorAboveTheLuaArityBoundKeepsThePackedPath() {
+        StringBuilder args = new StringBuilder();
+        int n = 70;
+        for (int i = 1; i <= n; i++) {
+            if (i > 1) {
+                args.append(", ");
+            }
+            args.append(i);
+        }
+        test().testLua(true).executeProg().lines(
+            "package Test",
+            "native testSuccess()",
+            "class Tally",
+            "    int total = 0",
+            "    construct(vararg int xs)",
+            "        for x in xs",
+            "            total += x",
+            "init",
+            "    let big = new Tally(" + args + ")",
+            "    let small = new Tally(1, 2)",
+            "    if big.total == " + (n * (n + 1) / 2) + " and small.total == 3",
+            "        testSuccess()"
+        );
+    }
+
     @Test
     public void virtuallyDispatchedVarargMethodKeepsThePackedPath() throws IOException {
         test().testLua(true).executeProg().lines(