vm: more use of ctx->replace().
vm: use ctx->push since unbox_array_size needs to peek at the stack.