GeezerVison

Follows #41. Arrays now convert in both directions for every element type, on both engines, including arrays WinRT allocates and hands back. Before, those were refused when the call was built ("Unsupported array return type"). Three commits:

1. Arrays WinRT hands back

A received array takes two ABI slots, UINT32* length and T** data. MethodCall and PropertyCall lay these out for:

• array return values and array-typed property getters, which land in the call's return buffer;
• ByRef T[] parameters, as two out slots.

After the call, (length, data) is converted and the CoTaskMem array freed. The element type comes from classify_return, through the new ReturnKind::Array { element, element_type, size }:

String and object elements are taken over by the conversion, so nothing is left to release. Out parameters behave as they do for other types: classic accepts interop.out() or returns [result, ...outs]; napi needs interop.out().

const out = interop.out();
CryptographicBuffer.CopyToByteArray(buffer, out); // out.value: Uint8Array
Windows.Graphics.Display.DisplayServices.FindAll(); // [{ Value: 65537 }]
new ListBoxAutomationPeer(list).GetSelection(); // [wrapper, wrapper]
certificateExtension.Value; // Uint8Array

Boxed arrays: IReferenceArray<T> values (from PropertyValue.Create*Array, a PropertySet, settings, device properties) unbox the way boxed scalars already do, through IPropertyValue.Get*Array and the same conversion. In the other direction, an Object parameter boxes these with PropertyValue, so a returned array can be passed back:

• typed arrays, which box as the matching IReferenceArray<T>;
• plain arrays whose elements are all strings, all numbers (Int32[] when they're all 32-bit integers, Double[] otherwise), all booleans, or all WinRT objects (or null).

2. Boxed Object arguments no longer leak

Every JS value boxed for an Object parameter (strings, numbers, booleans, struct shapes, and now arrays) used to forget its reference, so each argument leaked its box. Each call now opens a BoxedArgs scope, and the boxes made while parsing its arguments are released when the call returns. A call made during argument parsing (e.g. from a getter) opens its own scope and releases only its own boxes.

Inserting the same values into a PropertySet 200k times (napi, memory after GC):

The ~262 MB the no-boxing row still shows isn't a leak. It's napi finalizers waiting for the event loop, which this synchronous loop never yields to. With the loop yielding between 50k-call batches, memory levels off after a few batches.

3. String[] and object arrays passed in or filled

• Passed in (PropertyValue.CreateStringArray, IVector<T>.ReplaceAll, …): a JS array becomes HSTRINGs, or objects queried to the element's interface. They're released after the call.
• Filled by the callee (IVector<T>.GetMany): the caller passes a JS array as long as the slots it wants, and the results are written back into that array. interop.Array.create('String', n), ('Object', n) or ('Windows.Data.Json.IJsonValue', n) returns an array of nulls for this.
• Fill parameters are recognized by the [out] param attribute (ParameterDeclaration::is_fill_array).
• GenericMethodCall, which is only used for open generic interfaces, refuses these arrays rather than passing them as bytes.

Testing

• Rust unit tests:
  • array classification and layout
  • string/object element resolution
  • a box/unbox round trip through PropertyValue that frees the returned HSTRINGs
• End-to-end, 24/24 on Node with windows-napi, 23/23 on classic V8 (the XAML check needs a XAML host):
  • out byte[], including an empty one
  • struct-array return
  • boxed arrays of every primitive kind
  • String[]/Object[] passed in, and round trips through PropertySet
  • IVector<String>.ReplaceAll/GetMany, and GetMany returning the filled count
  • IVector<IJsonValue>.ReplaceAll/GetMany
  • CertificateExtension.Value set and get
  • ListBoxAutomationPeer.GetSelection() in a live XamlWindow
• Existing suites:
  • windows-napi npm test: 442/442
  • the feat(runtime): primitive arrays, interop.Array.create, delegates boxed for Object params #41 end-to-end checks: 27/27 napi, 24/24 classic
  • the events checks: 26/26
  • cargo test -p runtime --lib: the same failures as main

Not covered:

• IReferenceArray<T>.Value called directly on an interface instance. It goes through the same property path, but boxed arrays now unbox before JS can reach that member, so I couldn't test it.
• Struct arrays passed in (e.g. PropertyValue.CreatePointArray).