| Index: src/objects.cc | 
| diff --git a/src/objects.cc b/src/objects.cc | 
| index 7315496981c600dc910c6ec0b3a844db6a61e929..8b4662d1899fc7634c22376eccccbcad0419fc90 100644 | 
| --- a/src/objects.cc | 
| +++ b/src/objects.cc | 
| @@ -133,6 +133,8 @@ MaybeHandle<Object> Object::GetProperty(LookupIterator* it) { | 
| return GetPropertyWithAccessor(it->GetReceiver(), it->name(), | 
| it->GetHolder<JSObject>(), | 
| it->GetAccessors()); | 
| +      case LookupIterator::INTEGER_INDEXED_EXOTIC: | 
| +        return it->factory()->undefined_value(); | 
| case LookupIterator::DATA: | 
| return it->GetDataValue(); | 
| } | 
| @@ -168,6 +170,8 @@ Handle<Object> JSObject::GetDataProperty(LookupIterator* it) { | 
| // relevant. | 
| it->NotFound(); | 
| return it->isolate()->factory()->undefined_value(); | 
| +      case LookupIterator::INTEGER_INDEXED_EXOTIC: | 
| +        return it->isolate()->factory()->undefined_value(); | 
| case LookupIterator::DATA: | 
| return it->GetDataValue(); | 
| } | 
| @@ -3130,6 +3134,10 @@ MaybeHandle<Object> Object::SetPropertyInternal(LookupIterator* it, | 
| it->GetHolder<JSObject>(), | 
| it->GetAccessors(), language_mode); | 
|  | 
| +      case LookupIterator::INTEGER_INDEXED_EXOTIC: | 
| +        done = true; | 
| +        break; | 
| + | 
| case LookupIterator::DATA: | 
| if (it->property_details().IsReadOnly()) { | 
| return WriteToReadOnlyProperty(it, value, language_mode); | 
| @@ -3192,6 +3200,9 @@ MaybeHandle<Object> Object::SetSuperProperty(LookupIterator* it, | 
| return JSObject::AddDataProperty(&own_lookup, value, NONE, language_mode, | 
| store_mode); | 
|  | 
| +    case LookupIterator::INTEGER_INDEXED_EXOTIC: | 
| +      return result; | 
| + | 
| case LookupIterator::DATA: { | 
| PropertyDetails details = own_lookup.property_details(); | 
| if (details.IsConfigurable() || !details.IsReadOnly()) { | 
| @@ -3321,16 +3332,14 @@ MaybeHandle<Object> Object::AddDataProperty(LookupIterator* it, | 
| return WriteToReadOnlyProperty(it, value, language_mode); | 
| } | 
|  | 
| +  if (it->state() == LookupIterator::INTEGER_INDEXED_EXOTIC) return value; | 
| + | 
| Handle<JSObject> receiver = it->GetStoreTarget(); | 
|  | 
| // If the receiver is a JSGlobalProxy, store on the prototype (JSGlobalObject) | 
| // instead. If the prototype is Null, the proxy is detached. | 
| if (receiver->IsJSGlobalProxy()) return value; | 
|  | 
| -  // If the receiver is Indexed Exotic object (currently only typed arrays), | 
| -  // disallow adding properties with numeric names. | 
| -  if (it->IsSpecialNumericIndex()) return value; | 
| - | 
| // Possibly migrate to the most up-to-date map that will be able to store | 
| // |value| under it->name() with |attributes|. | 
| it->PrepareTransitionToDataProperty(value, attributes, store_mode); | 
| @@ -4158,6 +4167,7 @@ MaybeHandle<Object> JSObject::SetOwnPropertyIgnoreAttributes( | 
| !it.isolate()->IsInternallyUsedPropertyName(name); | 
| for (; it.IsFound(); it.Next()) { | 
| switch (it.state()) { | 
| +      case LookupIterator::INTEGER_INDEXED_EXOTIC: | 
| case LookupIterator::INTERCEPTOR: | 
| case LookupIterator::JSPROXY: | 
| case LookupIterator::NOT_FOUND: | 
| @@ -4336,6 +4346,8 @@ Maybe<PropertyAttributes> JSReceiver::GetPropertyAttributes( | 
| case LookupIterator::ACCESS_CHECK: | 
| if (it->HasAccess()) break; | 
| return JSObject::GetPropertyAttributesWithFailedAccessCheck(it); | 
| +      case LookupIterator::INTEGER_INDEXED_EXOTIC: | 
| +        return Just(ABSENT); | 
| case LookupIterator::ACCESSOR: | 
| case LookupIterator::DATA: | 
| return Just(it->property_details().attributes()); | 
| @@ -5337,6 +5349,8 @@ MaybeHandle<Object> JSObject::DeleteProperty(Handle<JSObject> object, | 
| if (it.isolate()->has_pending_exception()) return maybe_result; | 
| break; | 
| } | 
| +      case LookupIterator::INTEGER_INDEXED_EXOTIC: | 
| +        return it.isolate()->factory()->true_value(); | 
| case LookupIterator::DATA: | 
| if (is_observed) { | 
| old_value = it.GetDataValue(); | 
| @@ -6764,6 +6778,8 @@ MaybeHandle<Object> JSObject::GetAccessor(Handle<JSObject> object, | 
| case LookupIterator::JSPROXY: | 
| return isolate->factory()->undefined_value(); | 
|  | 
| +        case LookupIterator::INTEGER_INDEXED_EXOTIC: | 
| +          return isolate->factory()->undefined_value(); | 
| case LookupIterator::DATA: | 
| continue; | 
| case LookupIterator::ACCESSOR: { | 
|  |