The following code prints the correct length 2 times, then -1 8 times: var largestInteger = 4294967295; var array = new Array(); array[largestInteger - 1] = "test"; for (var i = 0; i < 10; ++i) print(array.length); This is a regression of CTI with respect to bytecode.
Created attachment 25092 [details] Fix
Comment on attachment 25092 [details] Fix r=me if you add the example given as a layout test in fast/js/pic.
Sending JavaScriptCore/ChangeLog Sending JavaScriptCore/VM/CTI.cpp Sending LayoutTests/ChangeLog Adding LayoutTests/fast/js/pic/cached-array-length-access-expected.txt Adding LayoutTests/fast/js/pic/cached-array-length-access.html Transmitting file data ..... Committed revision 38334.