Andreas tried this and broke gmail for want of a length accessor, IIRC. It may have been more subtle than that. I'll try to find the bug. /be

It was kinda subtle. The code only tolerates making dense arrays that then become slow. The slowification path makes the "length" property on slow arrays. If you allocate a slow array without going through that path, there is no resolve hook to make 'length'.

What's the advantage of doing this?

Its currently born as a dense array, only to be slowified during construction since it contains named properties.

Slow arrays were removed in https://hg.mozilla.org/mozilla-central/rev/f4671ccc4502.