The change made in r129676: <http://trac.webkit.org/changeset/129676> from https://bugs.webkit.org/show_bug.cgi?id=97691 needs to clear array slots between length and vectorLength when new slots are added to the end of an array.
Created attachment 166580 [details] Patch
Comment on attachment 166580 [details] Patch Clearing flags on attachment: 166580 Committed r130109: <http://trac.webkit.org/changeset/130109>
All reviewed patches have been landed. Closing bug.