Fix #3799 and three related stackalloc initializer decompilation defects

[siegfriedpammer]

Fixes #3799, and bundles three independent stackalloc initializer decompilation defects found alongside it.

Only the first change below is the reported crash and the actual #3799 fix. The other three were uncovered by an exploratory testing sweep over the surrounding code (varying element types, element positions, allocation shapes, and use contexts, validating each result by recompiling it); they are unrelated improvements and do not reference the issue.

1. Element type lost when the type hint is not a pointer (the reported crash, fixes #3799)

A constant-size stackalloc initializer whose buffer is passed to a static call without being dereferenced threw given Block is invalid! (reproduced on the reporter's JetBrains.HabitatDetector.dll). The element type is recovered from the surrounding type hint, but for this shape the folded constant size erases the sizeof and optimized codegen keeps the buffer as a native int, so the hint is not a pointer and the element type fell back to byte. Derive it from the type actually being stored.

2. float/double constants decoded as raw integer bits

A mixed float/double initializer stores its constant prefix through a data blob; ReadElement decoded each element by width, so 1f was read as Int32 and emitted as 1.0653532E+09f (and the wrong stack type tripped StObj.CheckInvariant). Dispatch on the type code so Single/Double are read as floating-point, matching the heap-array decoder.

3. Partially written reinterpreted buffer reconstructed as an initializer

byte* p = stackalloc byte[16] written through three of its four int slots decompiled to stackalloc int[4] { 1, v, 3 } — an initializer with fewer elements than the length, which does not compile. Only form the initializer when every element is written; otherwise keep individual stores.

4. Pointer-typed stackalloc inlined into an expression

A single-use pointer stackalloc was inlined into its use, producing K.V(stackalloc int[3] { 1, 2, v }) or *stackalloc ...; in expression position the stackalloc is typed Span<T>, which does not convert to a pointer, so the output did not compile. Keep it a local; inlining into a local store (its declaration) and into the Span<T>/ReadOnlySpan<T> constructor stay allowed.

Tests

Each fix adds a regression case to CS73_StackAllocInitializers (red without the fix in the relevant configurations, green with it). No regressions across the stackalloc/span/pointer-touching suites: CS73_StackAllocInitializers, InitializerTests, UnsafeCode, InlineArrayTests, RefFields, IndexRangeTest, ParamsCollections, PointerArithmetic, CompoundAssignmentTest, ExpressionTrees (Pretty), and UnsafeCode/InitializerTests (Correctness). The minimal repro and the real JetBrains.HabitatDetector method decompile correctly.

---

This PR description was written by an AI agent (Claude, claude-opus-4-8, via Claude Code).

[siegfriedpammer]

Reviewed the full diff. The four fixes are each narrowly scoped and individually test-covered:

1. ExpressionBuilder — falling back to the stored type t whenever the hint is not a usable PointerType (not only when incompatible) is correct; a non-pointer hint previously left the element type mis-derived.
2. ReadElement float/double — required: the GetSize() switch would otherwise decode a float via ReadInt32/LdcI4, producing both the wrong bit pattern and the wrong stack type (violating StObj.CheckInvariant).
3. ILInlining — the StackType.I + LocAlloc/StackAllocInitializer + non-StLoc-parent gate is suitably narrow, and IsStackAllocSpanConstructorArgument correctly limits the one permitted inline position to the first (pointer) argument of a Span<T>/ReadOnlySpan<T> constructor.
4. HandleSequentialLocAllocInitializer — Array.IndexOf(values, null) >= 0 correctly rejects partially-written buffers that cannot be represented as an initializer.

No correctness concerns. (GitHub does not allow approving one's own PR, so this is a comment rather than a formal approval.)

(This review was written by an AI agent on behalf of Siegfried Pammer.)