Bug 22201 – Caching of array length gives incorrect length for an array of maximum size

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Cameron Zwarich (cpst)]

The following code prints the correct length 2 times, then -1 8 times:

var largestInteger = 4294967295;
var array = new Array();
array[largestInteger - 1] = "test";

for (var i = 0; i < 10; ++i)
    print(array.length);

This is a regression of CTI with respect to bytecode.

[Gavin Barraclough]

Created attachment 25092 [details]
Fix

[Cameron Zwarich (cpst)]

Comment on attachment 25092 [details]
Fix

r=me if you add the example given as a layout test in fast/js/pic.

[Gavin Barraclough]

Sending        JavaScriptCore/ChangeLog
Sending        JavaScriptCore/VM/CTI.cpp
Sending        LayoutTests/ChangeLog
Adding         LayoutTests/fast/js/pic/cached-array-length-access-expected.txt
Adding         LayoutTests/fast/js/pic/cached-array-length-access.html
Transmitting file data .....
Committed revision 38334.