diff --git a/src/v8natives.js b/src/v8natives.js index 76d37fa2ae..83b561859a 100644 --- a/src/v8natives.js +++ b/src/v8natives.js @@ -932,7 +932,7 @@ function DefineArrayProperty(obj, p, desc, should_throw) { // Step 4 - Special handling for array index. var index = ToUint32(p); - if (index == ToNumber(p) && index != 4294967295) { + if (ToString(index) == p && index != 4294967295) { var length = obj.length; var length_desc = GetOwnProperty(obj, "length"); if ((index >= length && !length_desc.isWritable()) || diff --git a/test/mjsunit/object-define-property.js b/test/mjsunit/object-define-property.js index 970a803349..835d0e0a55 100644 --- a/test/mjsunit/object-define-property.js +++ b/test/mjsunit/object-define-property.js @@ -918,6 +918,11 @@ assertFalse(desc.writable); assertFalse(desc.enumerable); assertFalse(desc.configurable); +// Define non-array property, check that .length is unaffected. +assertEquals(16, arr.length); +Object.defineProperty(arr, '0x20', descElement); +assertEquals(16, arr.length); + // See issue 968: http://code.google.com/p/v8/issues/detail?id=968 var o = { x : 42 }; Object.defineProperty(o, "x", { writable: false });