Replaces two non-private uses of AddProperty with IgnoreAttributesAndSetLocal...

src/accessors.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 104 matching lines @@
   // Restore raw pointers,
   object = *object_handle;
   value = *value_handle;
 
   if (uint32_v->Number() == number_v->Number()) {
     if (object->IsJSArray()) {
       return JSArray::cast(object)->SetElementsLength(*uint32_v);
     } else {
       // This means one of the object's prototypes is a JSArray and
       // the object does not have a 'length' property.
-      return object->AddProperty(Heap::length_symbol(), value, NONE);
+      // Calling SetProperty causes an infinite loop.
+      return object->IgnoreAttributesAndSetLocalProperty(Heap::length_symbol(),
+                                                         value, NONE);
     }
   }
-
   return Top::Throw(*Factory::NewRangeError("invalid_array_length",
                                             HandleVector<Object>(NULL, 0)));
 }
 
 
 const AccessorDescriptor Accessors::ArrayLength = {
   ArrayGetLength,
   ArraySetLength,
   0
 };
@@ skipping 360 matching lines @@
 }
 
 
 const AccessorDescriptor Accessors::ObjectPrototype = {
   ObjectGetPrototype,
   ObjectSetPrototype,
   0
 };
 
 } }  // namespace v8::internal