GetTypedArrayLengthAsInt52 is marked in DFGNodeTypes.h as NodeResultJS. This is a complete lie: it actually returns an Int52. The reason for this lie is that FixupPhase is the part responsible for making its users expect and Int52, and the ByteCodeParser can emit GetTypedArrayLengthAsInt52 before it runs, leading to validation failures. It works because FixupPhase takes care to properly set the return type of every GetTypedArrayLengthAsInt52 it sees.. but DFGSSALoweringPhase.cpp runs after Fixup and can insert a GetTypedArrayLengthAsInt52, and so it must also take care to properly set its return type.
Created attachment 441680 [details] Patch I have not managed to find a test case for this yet.
*** This bug has been marked as a duplicate of bug 232059 ***