651978 - TI+JM: incorrect result with array length

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f() {
    for (var i=0; i<20; i++) {
    }
    var arr = [{}, null];
    var len = arr.length;
    arr[undefined] = 123;
    assertEq(len, 2);
}
f();
--
$ ./js -n -m test.js
test.js:7: Error: Assertion failed: got (void 0), expected 2

I thought this was related to array length hoisting but was able to reduce it further. 

After recompiling for the setelem, |len| is restored. The type register has |undefined| tag instead of int32, probably because it was not synced.

Comment 1

[Brian Hackett [Laid off!]]

Same issue as bug 651627, we expected the type tag for arr/len to have been synced at script entry, which the interpreter didn't do.  Fixed by rev 90a7b141e0cf.