diff --git a/ecmascript/js_array.cpp b/ecmascript/js_array.cpp
index 3307477ecc6c0a2870f3e602f33d3a5e03c50e5f..255f73caf04fd5f3dc9451b3c326c50c07f43ba3 100644
--- a/ecmascript/js_array.cpp
+++ b/ecmascript/js_array.cpp
@@ -213,10 +213,13 @@ void JSArray::SetCapacity(JSThread *thread, const JSHandle<JSObject> &array, uin
             JSHandle<NumberDictionary> dictHandle(thread, element);
             JSHandle<TaggedArray> newArr = factory->NewTaggedArray(numOfElements);
             GetAllElementKeys(thread, array, 0, newArr);
-            for (uint32_t i = numOfElements - 1; i >= newLen; i--) {
+            for (int32_t i = numOfElements - 1; i >= 0; i--) {
                 JSTaggedValue value = newArr->Get(i);
                 uint32_t output = 0;
                 JSTaggedValue::StringToElementIndex(value, &output);
+                if (output < newLen) {
+                    break;
+                }
                 JSTaggedValue key(static_cast<int>(output));
                 int entry = dictHandle->FindEntry(key);
                 auto attr = dictHandle->GetAttributes(entry).GetValue();
@@ -224,10 +227,6 @@ void JSArray::SetCapacity(JSThread *thread, const JSHandle<JSObject> &array, uin
                 if (propAttr.IsConfigurable()) {
                     JSHandle<NumberDictionary> newDict = NumberDictionary::Remove(thread, dictHandle, entry);
                     array->SetElements(thread, newDict);
-                    if (i == 0) {
-                        newNumOfElements = i;
-                        break;
-                    }
                 } else {
                     newNumOfElements = i + 1;
                     break;
diff --git a/ecmascript/js_stable_array.cpp b/ecmascript/js_stable_array.cpp
index d981726a9ded9c3fda4e500dce47289ce46cd46a..44883ebfa9326766a6363d2fe7d0e2b670cdd4d0 100644
--- a/ecmascript/js_stable_array.cpp
+++ b/ecmascript/js_stable_array.cpp
@@ -1137,7 +1137,17 @@ JSTaggedValue JSStableArray::FastCopyFromArrayToTypedArray(JSThread *thread, JSH
         }
     } else {
         double val = 0.0;
+        double backupVal = 0.0;
         uint32_t copyLen = srcLength > elemLen ? elemLen : srcLength;
+
+        JSTaggedValue* taggedValBackup = (JSTaggedValue*)malloc(sizeof(JSTaggedValue) * copyLen);
+        if (taggedValBackup == NULL) {
+            return JSTaggedValue::Undefined();
+        }
+        for (uint32_t i = 0; i < copyLen; i++) {
+            taggedValBackup[i] = ElementAccessor::Get(obj, i);
+        }
+
         for (uint32_t i = 0; i < copyLen; i++) {
             JSTaggedValue taggedVal = ElementAccessor::Get(obj, i);
             if (!taggedVal.IsNumber()) {
@@ -1145,13 +1155,18 @@ JSTaggedValue JSStableArray::FastCopyFromArrayToTypedArray(JSThread *thread, JSH
                 RETURN_EXCEPTION_IF_ABRUPT_COMPLETION(thread);
                 val = taggedNumber.GetNumber();
             } else {
+                backupVal = taggedValBackup[i].GetNumber();
                 val = taggedVal.GetNumber();
+                if (backupVal != val) {
+                    val = backupVal;
+                }
             }
             BuiltinsArrayBufferType<typedArrayKind>::Type::FastSetValueInBuffer(
                 thread, targetBuffer.GetTaggedValue(), targetByteIndex, targetType, val, true);
             RETURN_EXCEPTION_IF_ABRUPT_COMPLETION(thread);
             targetByteIndex += targetElementSize;
         }
+        free(taggedValBackup);
 
         for (uint32_t i = copyLen; i < srcLength; i++) {
             val = JSTaggedNumber(base::NAN_VALUE).GetNumber();
diff --git a/test/regresstest/regresstest_skip_tests.json b/test/regresstest/regresstest_skip_tests.json
index 0983e1afc517f52415096b1b18446ee21dc11fbd..2dc62cc3ff1b77053cdc8406089ea01887e2768b 100644
--- a/test/regresstest/regresstest_skip_tests.json
+++ b/test/regresstest/regresstest_skip_tests.json
@@ -1976,7 +1976,6 @@
         "mjsunit/call.js",
         "mjsunit/function-bind-name.js",
         "mjsunit/large-object-literal.js",
-        "mjsunit/array-length.js",
         "mjsunit/math-min-max.js",
         "mjsunit/regexp-capture-3.js",
         "mjsunit/tzoffset-transition-apia.js",
@@ -2957,7 +2956,6 @@
         "mjsunit/harmony/weakrefs/basics.js",
         "mjsunit/harmony/weakrefs/symbol-as-weakref-target.js",
         "mjsunit/es6/map-iterator-10.js",
-        "mjsunit/es6/typedarray-construct-by-array-like.js",
         "mjsunit/es6/string-replace.js",
         "mjsunit/es6/destructuring.js",
         "mjsunit/es6/home-object-in-context.js",