Suggestion for 1717.

src/bootstrapper.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1455 matching lines @@
 }
 
 
 void Genesis::BuildSpecialFunctionTable() {
   HandleScope scope;
   Handle<JSObject> global = Handle<JSObject>(global_context()->global());
   // Add special versions for Array.prototype.pop and push.
   Handle<JSFunction> function =
       Handle<JSFunction>(
           JSFunction::cast(global->GetProperty(Heap::Array_symbol())));
-  Handle<JSObject> prototype =
+  Handle<JSObject> hidden_prototype =
       Handle<JSObject>(JSObject::cast(function->prototype()));
-  AddSpecialFunction(prototype, "pop",
+  ASSERT(hidden_prototype->map()->is_hidden_prototype());
+  // Remember to skip the hidden prototype:
+  Handle<JSObject> real_prototype =
+      Handle<JSObject>(JSObject::cast(hidden_prototype->GetPrototype()));
+  AddSpecialFunction(real_prototype, "pop",
                      Handle<Code>(Builtins::builtin(Builtins::ArrayPop)));
-  AddSpecialFunction(prototype, "push",
+  AddSpecialFunction(real_prototype, "push",
                      Handle<Code>(Builtins::builtin(Builtins::ArrayPush)));
 }
 
 
 Genesis::Genesis(Handle<Object> global_object,
                  v8::Handle<v8::ObjectTemplate> global_template,
                  v8::ExtensionConfiguration* extensions) {
   // Link this genesis object into the stacked genesis chain. This
   // must be done before any early exits because the destructor
   // will always do unlinking.
@@ skipping 59 matching lines @@
 }
 
 
 // Restore statics that are thread local.
 char* Genesis::RestoreState(char* from) {
   current_ = *reinterpret_cast<Genesis**>(from);
   return from + sizeof(current_);
 }
 
 } }  // namespace v8::internal