putByIndex() provides similar behavior to put(), but for indexed property names. Many places in ArrayPrototype call putByIndex() where they really mean to call [[DefineOwnProperty]]. This is only okay due to a bug – putByIndex should be calling numeric accessors (& respecting numeric read only properties) on the prototype chain, but isn't. Add a new putDirectIndex (matching JSObject's putDirect* methods), to correctly provide a fast [[DefineOwnProperty]] interface.
Created attachment 130012 [details] Fix No new tests – this does not yet change behavior (errors were not reachable, since ArrayPrototype is always creating new properties).
Attachment 130012 [details] did not pass style-queue: Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'Source/JavaScriptCore/ChangeLog', u'Source..." exit_code: 1 Source/JavaScriptCore/runtime/JSArray.h:168: Place brace on its own line for function definitions. [whitespace/braces] [4] Source/JavaScriptCore/runtime/JSArray.h:298: The parameter name "exec" adds no information, so it should be removed. [readability/parameter_name] [5] Source/JavaScriptCore/runtime/JSArray.h:298: The parameter name "value" adds no information, so it should be removed. [readability/parameter_name] [5] Total errors found: 3 in 4 files If any of these errors are false positives, please file a bug against check-webkit-style.
Fixed in r109673