Inconsistent behaviour of enumerable flag of length property in arguments object

[Erik Krogh Kristensen]

Created attachment 255917 [details]
Demonstration of the problem

There are two ways of accessing the arguments object in JavaScriptCore, with the arguments variable, and with Function.argument. Below is a function that accesses both these values: 

function example() {
   print(arguments);
   print(example.arguments);
}

The two objects both contains the arguments given to the function, but they disagree on the value of the enumerable flag on the length attribute. In "arguments" it is false, whereas in "example.arguments" it is true. 
This has the effect, among other things, that printing out the arguments with JSON.stringify will incorrectly include the length attribute when printing out the arguments object. 

According to the ECMAScript Language Specification, the correct behavior is that the enumerable flag is set to false. (Both SpiderMonkey and V8 agree with this). 

This was tested on a recently checked out version of WebKit, compiled on Ubuntu 15.04. 

A testcase has been attached that demonstrates the issue.

--- Expected value ---
{
 "length1": false,
 "length2": false,
 "funcArgs": {
  "0": "P",
  "1": "A",
  "2": "S",
  "3": "S"
 },
 "args": {
  "0": "P",
  "1": "A",
  "2": "S",
  "3": "S"
 }
}


--- Actual value ---
{
 "length1": true,
 "length2": false,
 "funcArgs": {
  "0": "P",
  "1": "A",
  "2": "S",
  "3": "S",
  "length": 4
 },
 "args": {
  "0": "P",
  "1": "A",
  "2": "S",
  "3": "S"
 }
}