Summary
Reassigning a let binding initialized as a typed array to a plain array makes subsequent indexed reads return wrong values — the read path keeps using the typed-array lowering keyed on the binding's initial/declared type instead of dispatching on the runtime value.
Repro
let a: Int32Array = new Int32Array(4);
a[0] = 7; a[1] = 9;
console.log("ta", a[0], a[1]); // ta 7 9 ✓
a = [1, 2, 3] as any;
console.log("plain", a[0], a[1], a[2]);
- Node:
plain 1 2 3
- perry 0.5.1220 (release):
plain 0 0 0
- current main (
b0d789dab-era build): reads return undefined (same family, different wrong value)
Analysis
local_types is declaration-scoped and never killed on reassignment (no LocalSet writer anywhere; confirmed during the Phase 2 recon for docs/representation-selection-rfc.md), so receiver_class_name/the typed-array read paths keep firing for a binding that now holds a plain array. Pre-existing on main — reproduced on builds predating the representation-selection PRs; #6905's specialized-ABI eligibility explicitly excludes reassigned bindings (its reassignment gap test covers the specialized path), but the general non-specialized read path retains the bug.
Likely fix direction: a reassignment kill for local_types-derived receiver proofs (has_any_mutation-style, as used by the Buffer-param data-ptr hoist), or runtime-dispatching the read when the binding is ever reassigned to a differently-shaped value.
Summary
Reassigning a
letbinding initialized as a typed array to a plain array makes subsequent indexed reads return wrong values — the read path keeps using the typed-array lowering keyed on the binding's initial/declared type instead of dispatching on the runtime value.Repro
plain 1 2 3plain 0 0 0b0d789dab-era build): reads returnundefined(same family, different wrong value)Analysis
local_typesis declaration-scoped and never killed on reassignment (noLocalSetwriter anywhere; confirmed during the Phase 2 recon fordocs/representation-selection-rfc.md), soreceiver_class_name/the typed-array read paths keep firing for a binding that now holds a plain array. Pre-existing on main — reproduced on builds predating the representation-selection PRs; #6905's specialized-ABI eligibility explicitly excludes reassigned bindings (its reassignment gap test covers the specialized path), but the general non-specialized read path retains the bug.Likely fix direction: a reassignment kill for
local_types-derived receiver proofs (has_any_mutation-style, as used by the Buffer-param data-ptr hoist), or runtime-dispatching the read when the binding is ever reassigned to a differently-shaped value.