Skip to content

let binding reassigned from Int32Array to plain array keeps typed-array read lowering (wrong values: 0/undefined instead of elements) #6906

Description

@proggeramlug

Summary

Reassigning a let binding initialized as a typed array to a plain array makes subsequent indexed reads return wrong values — the read path keeps using the typed-array lowering keyed on the binding's initial/declared type instead of dispatching on the runtime value.

Repro

let a: Int32Array = new Int32Array(4);
a[0] = 7; a[1] = 9;
console.log("ta", a[0], a[1]);      // ta 7 9  ✓
a = [1, 2, 3] as any;
console.log("plain", a[0], a[1], a[2]);
  • Node: plain 1 2 3
  • perry 0.5.1220 (release): plain 0 0 0
  • current main (b0d789dab-era build): reads return undefined (same family, different wrong value)

Analysis

local_types is declaration-scoped and never killed on reassignment (no LocalSet writer anywhere; confirmed during the Phase 2 recon for docs/representation-selection-rfc.md), so receiver_class_name/the typed-array read paths keep firing for a binding that now holds a plain array. Pre-existing on main — reproduced on builds predating the representation-selection PRs; #6905's specialized-ABI eligibility explicitly excludes reassigned bindings (its reassignment gap test covers the specialized path), but the general non-specialized read path retains the bug.

Likely fix direction: a reassignment kill for local_types-derived receiver proofs (has_any_mutation-style, as used by the Buffer-param data-ptr hoist), or runtime-dispatching the read when the binding is ever reassigned to a differently-shaped value.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions