Closed Bug 651978 Opened 9 years ago Closed 9 years ago

TI+JM: incorrect result with array length

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

(Blocks 1 open bug)

Details

--
function f() {
    for (var i=0; i<20; i++) {
    }
    var arr = [{}, null];
    var len = arr.length;
    arr[undefined] = 123;
    assertEq(len, 2);
}
f();
--
$ ./js -n -m test.js
test.js:7: Error: Assertion failed: got (void 0), expected 2

I thought this was related to array length hoisting but was able to reduce it further. 

After recompiling for the setelem, |len| is restored. The type register has |undefined| tag instead of int32, probably because it was not synced.
Same issue as bug 651627, we expected the type tag for arr/len to have been synced at script entry, which the interpreter didn't do.  Fixed by rev 90a7b141e0cf.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.