minify: do not fold new Array(x, ...spread) into an array literal

[robobun]

Problem

• With minify_syntax, new Array(5, ...rest) becomes [5, ...rest]. When rest is empty the original means new Array(5), five holes, and the fold is [5]. For const none = []; const a = new Array(5, ...none); console.log(a.length, 0 in a) Node prints 5 false. Bun 1.4.3 prints 1 true under bun run and in bun build --minify-syntax output.
• The cause is the more-than-one-argument branch of KnownGlobal::minify_global_constructor (src/ast/known_global.rs:244). It folds the arguments into a literal without checking for a spread, so the argument count can differ at runtime.

Fix

• If any argument is a spread, emit Array(5, ...rest) instead of a literal. This is the call_from_new form the single-argument branch already uses when the argument may be a number.
• Correct because Array called as a function behaves like new Array (ECMA-262 23.1.1). Only the literal fold was unsound.
• EXPECTED_VERSION in RuntimeTranspilerCache.rs moves to 29: the runtime transpiler enables minify_syntax, so its cached output changes.
• Verified: test/bundler/bundler_minify.test.ts (one case captures the output, one runs it, both fail on 1.4.3). Also bundler_npm.test.ts and minify-new-array-with-if.test.ts.

Background

• minify_global_constructor is the byte-saving rewrite from feat(minify): optimize Error constructors by removing 'new' keyword #22493: new Object() to {}, new Array(1, 2) to [1, 2], and new dropped from constructors that behave the same when called.
• new Array(n) with one number makes a sparse array of length n. Any other argument list makes an array of the arguments. A spread hides which case applies until runtime.
• This hunk comes from transpiler: stop minifying new Error() (and other known-global constructs) into calls that JSC tail-calls #37388, closed in favour of Keep stack frames and positions when the runtime transpiler minifies syntax #41580. It is independent of the stack-frame change there.

Notes

• new Array(...xs) alone was already safe: it is the single-argument branch and stays a call.
• Keep stack frames and positions when the runtime transpiler minifies syntax #41580 and minify: port esbuild's statement-level syntax passes #41159 also bump the transpiler cache version. Whichever lands second bumps again.
• Keep stack frames and positions when the runtime transpiler minifies syntax #41580 gates minify_global_constructor on bundle, which hides this under bun run but not in bun build --minify output. This PR fixes the fold itself, so it is needed either way.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Essentials

Run ID: 7a65fa38-4b30-4d99-a005-1fed99db1ce9

📥 Commits

Reviewing files that changed from the base of the PR and between ae3c3ad and fb5b797.

📒 Files selected for processing (3)

• src/ast/known_global.rs
• src/jsc/RuntimeTranspilerCache.rs
• test/bundler/bundler_minify.test.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

Walkthrough

Changes

The minifier now preserves new Array(...) when arguments include spreads. The runtime transpiler cache version is incremented. Bundler tests cover unknown spreads and sparse arrays created with empty spreads.

Array constructor minification

Layer / File(s)	Summary
Preserve spread-based Array constructors src/ast/known_global.rs	The new Array(...) optimization detects spread arguments and retains the constructor call. Non-spread calls with multiple arguments remain foldable.
Update cache version and validation src/jsc/RuntimeTranspilerCache.rs, test/bundler/bundler_minify.test.ts	The cache version changes from 28 to 29. Tests cover unknown spreads, minified output, and sparse-array length and membership semantics.

Suggested reviewers: jarred-sumner

Merge Risk: ⚪ Minimal · up to fb5b7

Minified spread-based Array construction now preserves sparse-array semantics, with cache invalidation and regression coverage included. No current merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the problem, fix, rationale, cache version change, and verification. It does not use the exact template headings, but it provides the required information and is mostl…
Title check	✅ Passed	The title is concise, specific, and accurately summarizes the main change: preventing folding of new Array calls with spread arguments.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[robobun]

Status: ready for review.

Reproduced on Bun 1.4.3 with:

// entry.js
const none = [];
const a5 = new Array(5, ...none);
console.log(a5.length, 0 in a5);

• bun entry.js prints 1 true. Node prints 5 false.
• bun build --minify-syntax entry.js emits a5 = [5, ...none].

With this branch both print 5 false, and the bundle emits a5 = Array(5, ...none). test/bundler/bundler_minify.test.ts fails on 1.4.3 in minify/AdditionalGlobalConstructorOptimization and minify/GlobalConstructorSemanticsPreserved, and passes here (51/51 under the debug build).

Split out of #37388, which is closed in favour of #41580.

[github-actions]

If you need a paragraph-long comment to justify why the workaround is OK, the code is wrong — fix the code

[robobun]

^{Updated 11:40 PM PT - Sep 6th, 2026}

⏳ @autofix-ci[bot], your commit fb5b797 is still building in Build #112078, but has 2 failures so far (All Failures):

• test/js/node/test/parallel/test-crypto-dh-leak.js - code 1 on 🐧 13 x64-asan
• test/cli/install/isolated-install.test.ts - code 1 on 🐧 3.23 x64

[claude]

Code review found no issues

No high-confidence issues detected in this change.