The change made in r129676: <http://trac.webkit.org/changeset/129676> from https://bugs.webkit.org/show_bug.cgi?id=97691 needs to clear array slots between length and vectorLength when new slots are added to the end of an array.
Created attachment 166580 [details]
Comment on attachment 166580 [details]
Clearing flags on attachment: 166580
Committed r130109: <http://trac.webkit.org/changeset/130109>
All reviewed patches have been landed. Closing bug.