Properly process arrays with overridden prototype in various Array's functions.

test/mjsunit/array-slice.js

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 109 matching lines @@
       assertEquals([], sliced);  // Length was 0, nothing to get.
     } else {
       // Actually out of array [0..i] we get [i - 1] as length is i.
       assertEquals([i - 1], sliced);
     }
   }
 })();
 
 
 // Now check the case with array of holes and some elements on prototype.
+// Note: that is important that this test runs before the next one
+// as the next one tampers Array.prototype.
+(function() {
+  var len = 9;
+  var array = new Array(len);
+
+  var at3 = "@3";
+  var at7 = "@7";
+
+  for (var i = 0; i < 7; i++) {
+    var array_proto = [];
+    array_proto[3] = at3;
+    array_proto[7] = at7;
+    array.__proto__ = array_proto;
+
+    assertEquals(len, array.length);
+    for (var i = 0; i < array.length; i++) {
+      assertEquals(array[i], array_proto[i]);
+    }
+
+    var sliced = array.slice();
+
+    assertEquals(len, sliced.length);
+
+    assertTrue(delete array_proto[3]);
+    assertTrue(delete array_proto[7]);
+
+    // Note that slice copies values from prototype into the array.
+    assertEquals(array[3], undefined);
+    assertFalse(array.hasOwnProperty(3));
+    assertEquals(sliced[3], at3);
+    assertTrue(sliced.hasOwnProperty(3));
+
+    assertEquals(array[7], undefined);
+    assertFalse(array.hasOwnProperty(7));
+    assertEquals(sliced[7], at7);
+    assertTrue(sliced.hasOwnProperty(7));
+
+    // ... but keeps the rest as holes:
+    array_proto[5] = "@5";
+    assertEquals(array[5], array_proto[5]);
+    assertFalse(array.hasOwnProperty(5));
+  }
+})();
+
+
+// Now check the case with array of holes and some elements on prototype.
 (function() {
   var len = 9;
   var array = new Array(len);
 
   var at3 = "@3";
   var at7 = "@7";
 
   for (var i = 0; i < 7; i++) {
     Array.prototype[3] = at3;
     Array.prototype[7] = at7;
@@ skipping 24 matching lines @@
     // ... but keeps the rest as holes:
     Array.prototype[5] = "@5";
     assertEquals(array[5], Array.prototype[5]);
     assertFalse(array.hasOwnProperty(5));
     assertEquals(sliced[5], Array.prototype[5]);
     assertFalse(sliced.hasOwnProperty(5));
 
     assertTrue(delete Array.prototype[5]);
   }
 })();