User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C) Build Identifier: 4.0b7 A subclass of Array stops reporting the right length when an additional method is added to its prototype. This is a regression in 4.0b7, and is confirmed to work as expected in 4.0b6 and 3.5. Reproducible: Always Steps to Reproduce: Use the following code: function MyArray() {} MyArray.prototype=new Array(); MyArray.prototype.item=function (x) { return this[x]; } var arr=new MyArray(); arr.push("foo"); alert(arr.length); Actual Results: Alerts 0 in 4.0b7, alerts 1 in 4.0b6 and 3.5. Expected Results: Should alert 1.

Sorry, I meant 3.6 in the original report. Confirmed to be working as expected in 3.6.12, 3.5.13, 3.0.19 and 2.0.0.20.

Due to skipped revisions, the first bad revision could be any of: changeset: 53606:a55097cd48d8 user: Jim Blandy <jimb@mozilla.org> date: Wed Sep 15 13:43:54 2010 -0700 summary: Bug 537873, Bug 514574: Use ObjectOps::setProperty for both fast and slow arrays. r=brendan changeset: 53607:8f7761878ba5 user: Jim Blandy <jimb@mozilla.org> date: Wed Sep 15 13:43:54 2010 -0700 summary: Bug 537873, Bug 514574: Tests for strict mode assignments to read-only properties, deletions of non-configurable properties. r=jorendorff changeset: 53608:9cfceee11abd user: Jim Blandy <jimb@mozilla.org> date: Wed Sep 15 13:43:54 2010 -0700 summary: Bug 537873, Bug 514574: Delete unused property operation typedefs: JSDefinePropOp, JSPropertyIdOp. r=luke changeset: 53609:a409054e1395 user: Jim Blandy <jimb@mozilla.org> date: Wed Sep 15 13:43:55 2010 -0700 summary: Bug 537873, Bug 514574: Have strict mode code report TypeErrors for assignments, deletions. r=brendan

Probably from that ObjectOps::setProperty changeset.

Shorter: var a = Object.create(Array.prototype); a.push(3); assertEq(a.length, 1); For some reason the bug only happens if the prototype is a sparse array. If it's dense, the behavior is correct.