Fix redefining of attributes on aliased arguments.

test/mjsunit/object-define-property.js

Index: test/mjsunit/object-define-property.js
diff --git a/test/mjsunit/object-define-property.js b/test/mjsunit/object-define-property.js
index ee6083a8995f84c8313da480f511c59adaf3a675..432fbdf7fc3c325bccd11cd81e8e0f9d41a75d0b 100644
--- a/test/mjsunit/object-define-property.js
+++ b/test/mjsunit/object-define-property.js
@@ -1053,4 +1053,25 @@ for (var i = 0; i < 1000; i++) {
   // Non-enumerable property forces dictionary mode.
   Object.defineProperty(o, i, {value: i, enumerable: false});
 }
-assertEquals(999, o[999]);
+assertEquals(999, o[999]);
+
+
+// Regression test: Bizzare behavior on non-strict arguments object.
+(function test(arg0) {
+  // Here arguments[0] is a fast alias on arg0.
+  Object.defineProperty(arguments, "0", {
+    value:1,
+    enumerable:false
+  });
+  // Here arguments[0] is a slow alias on arg0.
+  Object.defineProperty(arguments, "0", {
+    value:2,
+    writable:false
+  });
+  // Here arguments[0] is no alias at all.
+  Object.defineProperty(arguments, "0", {
+    value:3
+  });
+  assertEquals(2, arg0);
+  assertEquals(3, arguments[0]);
+})(0);

[rossberg, 2012/02/24 13:51:05]

You could have another test that checks that everything still works correctly
when the arguments object escapes its owner function and is modified elsewhere.

[Michael Starzinger, 2012/02/24 14:36:41]

Done. As discussed offline, this is a white-box test for a code-path through our
implementation that is not covered by test262. Most other paths (including
manipulating the arguments object outside the function it was instantiated in)
are already covered by test262.