@@ -1,3 +1,15 @@
+2020-05-14  Keith Miller  <keith_miller@apple.com>
+
+        Undecided Arrays shouldn't need to be OriginalArray to covert to GetArrayLength
+        https://bugs.webkit.org/show_bug.cgi?id=211914
+
+        Reviewed by Saam Barati.
+
+        * stress/undecided-arrays-should-not-need-original-array-for-length.js: Added.
+        (findFoo):
+        (const.nonUndecidedFrequency.1000.SubArray):
+        (i.i.some):
+
 2020-05-14  Keith Miller  <keith_miller@apple.com>
 
         GetArrayLength should be "blessed" during Fixup phase in the DFG
 
@@ -0,0 +1,17 @@
+function findFoo(name, array, bail) {
+    let some = array.some
+    if (bail)
+        return;
+    some.call(array, function (v) {
+        return v === name;
+    });
+}
+noInline(findFoo);
+
+class SubArray extends Array {}
+for (let i = 0; i < 1e5; ++i) {
+    let array = i % 2 ? new SubArray(0) : ["foo"];
+    findFoo("foo", array, array.length);
+    for (let i = 0; i < 100; ++i)
+        [].some(function (v) { });
+}
@@ -1,3 +1,22 @@
+2020-05-14  Keith Miller  <keith_miller@apple.com>
+
+        Undecided Arrays shouldn't need to be OriginalArray to covert to GetArrayLength
+        https://bugs.webkit.org/show_bug.cgi?id=211914
+
+        Reviewed by Saam Barati.
+
+        Also, fix a bug that arrayModesThatPassFiltering() can't handle
+        Undecided arrays. Because we can now emit a CheckArray on
+        Undecided AI will try to figure out what types flow out of the
+        check. Since Undecided was unhandled by filtering, AI will assume
+        bottom is the only possible value and the DFG/FTL will insert a
+        breakpoint, causing a crash.
+
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine const):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::arrayModesThatPassFiltering const):
+
 2020-05-14  Keith Miller  <keith_miller@apple.com>
 
         GetArrayLength should be "blessed" during Fixup phase in the DFG
 
@@ -242,12 +242,16 @@ ArrayMode ArrayMode::refine(
             return withTypeAndConversion(Array::Double, Array::Convert);
         return withTypeAndConversion(Array::Contiguous, Array::Convert);
     case Array::Undecided: {
+        // As long as we have a JSArray getting its length shouldn't require any sane chainness.
+        if (canBecomeGetArrayLength(graph, node) && isJSArray())
+            return *this;
+
         // If we have an OriginalArray and the JSArray prototype chain is sane,
         // any indexed access always return undefined. We have a fast path for that.
         JSGlobalObject* globalObject = graph.globalObjectFor(node->origin.semantic);
         Structure* arrayPrototypeStructure = globalObject->arrayPrototype()->structure(graph.m_vm);
         Structure* objectPrototypeStructure = globalObject->objectPrototype()->structure(graph.m_vm);
-        if ((node->op() == GetByVal || canBecomeGetArrayLength(graph, node))
+        if (node->op() == GetByVal
             && isJSArrayWithOriginalStructure()
             && !graph.hasExitSite(node->origin.semantic, OutOfBounds)
             && arrayPrototypeStructure->transitionWatchpointSetIsStillValid()
 
@@ -430,6 +430,8 @@ class ArrayMode {
         switch (type()) {
         case Array::Generic:
             return ALL_ARRAY_MODES;
+        case Array::Undecided:
+            return arrayModesWithIndexingShapes(UndecidedShape);
         case Array::Int32:
             result = arrayModesWithIndexingShapes(Int32Shape);
             break;