When looking at the use of put in the engine, I discovered a mistake in the Array.prototype functions. When they operate on non-array objects, they create length attributes with the DontEnum and DontDelete flags set. That's wrong.
Created attachment 18792 [details] patch
Comment on attachment 18792 [details] patch It looks like this patch contains conflict markers. Maybe you could post a new one with the conflicts resolved?
Created attachment 18796 [details] patch with whitespace-merge-conflicts resolved When I resolved the conflict with the whitespace, I missed a couple cases and didn't recompile. Now I recompiled and re-tested.
Comment on attachment 18796 [details] patch with whitespace-merge-conflicts resolved While this looks great, I think it would be better to land the fix to the Array.prototype functions separate to all the other whitespace and putDirect changes, It's not necessary, but would be nice. r=me.
Committed revision 30041.