Defining non-enumerable, non-numeric property breaks for (key in obj) on enumerable, numeric properties

This was originally discovered on arrays, but I have since determined that it breaks objects in general. I'm writing a test inline because I'm not sure whether it should be a JavaScriptCore test or LayoutTest.

Test code:

var obj = { 0: 0, 1: 1, _2: 2 };
Object.defineProperty(obj, '_3', {});
for (var key in obj) console.log(key);

Test output:

0
1
0
1
_2

Testing notes:
- Problem occurs on arrays as well as Objects (given that it occurs on plain-old objects, this is not surprising)
- Problem occurs with Object.defineProperty and Object.defineProperties under the same conditions
- Problem only occurs when the newly define property is both non-numeric and non-enumerable (other property attributes do not appear to influence the outcome)
- The only keys that duplicate themselves are numeric keys (that are enumerable)
- Problem does not occur in return value of Object.keys(obj)