Fix another corner case for DefineOwnProperty on arrays.

src/v8natives.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 855 matching lines @@
   if (p == "length") {
     var length = obj.length;
     if (!desc.hasValue()) {
       return DefineObjectProperty(obj, "length", desc, should_throw);
     }
     var new_length = ToUint32(desc.getValue());
     if (new_length != ToNumber(desc.getValue())) {
       throw new $RangeError('defineProperty() array length out of range');
     }
     var length_desc = GetOwnProperty(obj, "length");
-    // Make sure the below call to DefineObjectProperty() doesn't overwrite
-    // any magic "length" property by removing the value.
-    desc.value_ = void 0;
-    desc.hasValue_ = false;
-    if ((new_length != length && !length_desc.isWritable()) ||
-        !DefineObjectProperty(obj, "length", desc, should_throw)) {
+    if (new_length != length && !length_desc.isWritable()) {
       if (should_throw) {
         throw MakeTypeError("redefine_disallowed", [p]);
       } else {
         return false;
       }
     }
+    var threw = false;
+    while (new_length < length--) {
+      if (!Delete(obj, ToString(length), false)) {
+        new_length = length + 1;
+        threw = true;
+        break;
+      }
+    }
+    // Make sure the below call to DefineObjectProperty() doesn't overwrite
+    // any magic "length" property by removing the value.
     obj.length = new_length;
-    while (new_length < length--) {
-      if (!Delete(obj, length, false)) {
-        obj.length = length + 1;
-        if (should_throw) {
-          throw MakeTypeError("redefine_disallowed", [p]);
-        } else {
-          return false;
-        }
+    desc.value_ = void 0;
+    desc.hasValue_ = false;
+    if (!DefineObjectProperty(obj, "length", desc, should_throw) || threw) {
+      if (should_throw) {
+        throw MakeTypeError("redefine_disallowed", [p]);
+      } else {
+        return false;
       }
     }
     return true;
   }
 
   // Step 4 - Special handling for array index.
   var index = ToUint32(p);
   if (index == ToNumber(p) && index != 4294967295) {
     var length = obj.length;
     var length_desc = GetOwnProperty(obj, "length");
@@ skipping 735 matching lines @@
 
 function SetUpFunction() {
   %CheckIsBootstrapping();
   InstallFunctions($Function.prototype, DONT_ENUM, $Array(
     "bind", FunctionBind,
     "toString", FunctionToString
   ));
 }
 
 SetUpFunction();