fix: 修复 array_push 返回值错误问题

crates/oxide_vm/src/builtins/array.rs

@@ -118,9 +118,9 @@ pub fn array_push(vm: &mut Vm, args: &[u8]) -> NativeResult {
         arr.set_prop_at(len as u8, val);
         len += 1;
     }
-    let new_len = (len as u8).min(31);
-    arr.set_prop_count(new_len);
-    Ok(JsValue::int(new_len as i32))
+    let stored_len = (len as u8).min(31);
+    arr.set_prop_count(stored_len);
+    Ok(JsValue::int(len as i32))
 }
 
 pub fn array_pop(vm: &mut Vm, args: &[u8]) -> NativeResult {

crates/oxide_vm/tests/builtins_array_tests.rs

@@ -1,4 +1,5 @@
 use oxide_compiler::compiler::Compiler;
+use oxide_vm::builtins::array::{array_constructor, array_push};
 use oxide_vm::vm::Vm;
 
 fn eval(source: &str) -> Result<oxide_types::value::JsValue, String> {
@@ -26,6 +27,17 @@ fn array_push_returns_length() {
     assert_eq!(result.as_int(), 4);
 }
 
+#[test]
+fn array_push_returns_true_length_beyond_31() {
+    let mut vm = Vm::new();
+    vm.set_reg(1, oxide_types::value::JsValue::int(31));
+    let array = array_constructor(&mut vm, &[0, 1]).unwrap();
+    vm.set_reg(0, array);
+    vm.set_reg(1, oxide_types::value::JsValue::int(99));
+    let result = array_push(&mut vm, &[0, 1]).unwrap();
+    assert_eq!(result.as_int(), 32);
+}
+
 #[test]
 fn array_pop_returns_last() {
     let result = eval("[1,2,3].pop()").unwrap();