22201 2008-11-12 01:56:01 -0800 Caching of array length gives incorrect length for an array of maximum size 2008-11-12 03:31:55 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED Regression P1 Normal --- 1 zwarich barraclough barraclough oldest_to_newest 98451 0 zwarich 2008-11-12 01:56:01 -0800 The following code prints the correct length 2 times, then -1 8 times: var largestInteger = 4294967295; var array = new Array(); array[largestInteger - 1] = "test"; for (var i = 0; i < 10; ++i) print(array.length); This is a regression of CTI with respect to bytecode. 98454 1 25092 barraclough 2008-11-12 02:24:47 -0800 Created attachment 25092 Fix 98455 2 25092 zwarich 2008-11-12 02:27:12 -0800 Comment on attachment 25092 Fix r=me if you add the example given as a layout test in fast/js/pic. 98461 3 barraclough 2008-11-12 03:31:55 -0800 Sending JavaScriptCore/ChangeLog Sending JavaScriptCore/VM/CTI.cpp Sending LayoutTests/ChangeLog Adding LayoutTests/fast/js/pic/cached-array-length-access-expected.txt Adding LayoutTests/fast/js/pic/cached-array-length-access.html Transmitting file data ..... Committed revision 38334. 25092 2008-11-12 02:24:47 -0800 2008-11-12 02:27:12 -0800 Fix patch.array.length.ooops.txt text/plain 1618 barraclough SW5kZXg6IEphdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZhU2NyaXB0 Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDM4MzMxKQorKysgSmF2YVNjcmlwdENvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAKKzIwMDgtMTEtMTIgIEdhdmluIEJh cnJhY2xvdWdoICA8YmFycmFjbG91Z2hAYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeCBmb3IgaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTIyMjAxCisgICAgICAgIEludGVnZXIgY29udmVyc2lvbiBpbiBh cnJheS5sZW5ndGggd2FzIHNhZmUgc2lnbmVkIHZhbHVlcywKKyAgICAgICAgYnV0IHRoZSBsZW5n dGggaXMgdW5zaWduZWQuCisKKyAgICAgICAgKiBWTS9DVEkuY3BwOgorICAgICAgICAoSlNDOjpD VEk6OnByaXZhdGVDb21waWxlUGF0Y2hHZXRBcnJheUxlbmd0aCk6CisKIDIwMDgtMTEtMTIgIENh bWVyb24gWndhcmljaCAgPHp3YXJpY2hAYXBwbGUuY29tPgogCiAgICAgICAgIFJ1YmJlci1zdGFt cGVkIGJ5IE1hcmsgUm93ZS4KSW5kZXg6IEphdmFTY3JpcHRDb3JlL1ZNL0NUSS5jcHAKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gSmF2YVNjcmlwdENvcmUvVk0vQ1RJLmNwcAkocmV2aXNpb24gMzgzMzEpCisrKyBK YXZhU2NyaXB0Q29yZS9WTS9DVEkuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0zNDI3LDE2ICszNDI3 LDEzIEBAIHZvaWQgQ1RJOjpwcml2YXRlQ29tcGlsZVBhdGNoR2V0QXJyYXlMZW4KICAgICBtX2pp dC5tb3ZsX21yKE9CSkVDVF9PRkZTRVQoSlNBcnJheSwgbV9zdG9yYWdlKSwgWDg2OjplYXgsIFg4 Njo6ZWN4KTsKICAgICBtX2ppdC5tb3ZsX21yKE9CSkVDVF9PRkZTRVQoQXJyYXlTdG9yYWdlLCBt X2xlbmd0aCksIFg4Njo6ZWN4LCBYODY6OmVjeCk7CiAKKyAgICBtX2ppdC5jbXBsX2kzMnIoSlNJ bW1lZGlhdGU6Om1heEltbWVkaWF0ZUludCwgWDg2OjplY3gpOworICAgIFg4NkFzc2VtYmxlcjo6 Sm1wU3JjIGZhaWx1cmVDYXNlczMgPSBtX2ppdC5lbWl0VW5saW5rZWRKYSgpOworCiAgICAgbV9q aXQuYWRkbF9ycihYODY6OmVjeCwgWDg2OjplY3gpOwotICAgIFg4NkFzc2VtYmxlcjo6Sm1wU3Jj IGZhaWx1cmVDbG9iYmVyZWRFQ1ggPSBtX2ppdC5lbWl0VW5saW5rZWRKbygpOwogICAgIG1faml0 LmFkZGxfaThyKDEsIFg4Njo6ZWN4KTsKLQogICAgIFg4NkFzc2VtYmxlcjo6Sm1wU3JjIHN1Y2Nl c3MgPSBtX2ppdC5lbWl0VW5saW5rZWRKbXAoKTsKIAotICAgIG1faml0LmxpbmsoZmFpbHVyZUNs b2JiZXJlZEVDWCwgbV9qaXQubGFiZWwoKSk7Ci0gICAgbV9qaXQuZW1pdFJlc3RvcmVBcmd1bWVu dFJlZmVyZW5jZSgpOwotICAgIFg4NkFzc2VtYmxlcjo6Sm1wU3JjIGZhaWx1cmVDYXNlczMgPSBt X2ppdC5lbWl0VW5saW5rZWRKbXAoKTsKLQogICAgIHZvaWQqIGNvZGUgPSBtX2ppdC5jb3B5KCk7 CiAgICAgQVNTRVJUKGNvZGUpOwogCg==