putByIndex() provides similar behavior to put(), but for indexed property names. Many places in ArrayPrototype call putByIndex() where they really mean to call [[DefineOwnProperty]]. This is only okay due to a bug – putByIndex should be calling numeric accessors (& respecting numeric read only properties) on the prototype chain, but isn't. Add a new putDirectIndex (matching JSObject's putDirect* methods), to correctly provide a fast [[DefineOwnProperty]] interface.
Created attachment 130012 [details]
No new tests – this does not yet change behavior (errors were not reachable, since ArrayPrototype is always creating new properties).
Attachment 130012 [details] did not pass style-queue:
Total errors found: 3 in 4 files
If any of these errors are false positives, please file a bug against check-webkit-style.
Fixed in r109673