See https://mail.mozilla.org/pipermail/es-discuss/2012-June/023694.html
In 15.4 ArrayCreate algorithm step 7, we use [[DefineOwnProperty]] of A.
> Call the [[DefineOwnProperty]] internal method of A with arguments
> "length", Property Desciptor {[[Value]]: length, [[Writable]]: true,
> [[Enumerable]]: false, [[Configurable]]: false}, and false.
ArrayCreate set A's [[DefineOwnProperty]] to 15.4.5.1 method in step 4, so
step 7 calls 15.4.5.1 Array's [[DefineOwnProperty]].
Array's [[DefineOwnProperty]] assumes that 'length' property is always set.
Seeing 15.4.5.1 step 1
> Let oldLenDesc be the result of calling the [[GetOwnProperty]] internal
> method of A passing "length" as the argument. The result will never be
> undefined or an accessor descriptor because Array objects are created with
> a length data property that cannot be deleted or reconfigured.
But, in ArrayCreate phase (step 7), A's 'length' property is not set yet.
Then assertion in 15.4.5.1 step 1 always fails.
So we should use the default [[DefineOwnProperty]] internal method instead
of Array's.
I suggest modifying ArrayCreate step 7,
Call the default [[DefineOwnProperty]] internal method (8.12.9) on A with
arguments "length", Property Desciptor {[[Value]]: length, [[Writable]]:
true, [[Enumerable]]: false, [[Configurable]]: false}, and false.
fixed in editor's draft
fixed in rev10, Sept. 27 2012 draft