Bug 1148652, part 3 - Mark arguments.length as overridden when it is redefined via the C API. r=efaust.

--HG--
extra : rebase_source : f08959c8e664c444f17839a7f41ea81cfb1e786b

js/src/vm/NativeObject.cpp

@@ -1309,6 +1309,16 @@ js::NativeDefineProperty(ExclusiveContext* cx, HandleNativeObject obj, HandleId
                 return false;
             return DefineTypedArrayElement(cx->asJSContext(), obj, index, desc_, result);
         }
+    } else if (obj->is<ArgumentsObject>()) {
+        if (id == NameToId(cx->names().length)) {
+            // Either we are resolving the .length property on this object, or
+            // redefining it. In the latter case only, we must set a bit. To
+            // distinguish the two cases, we note that when resolving, the
+            // property won't already exist; whereas the first time it is
+            // redefined, it will.
+            if (obj->containsPure(id))
+                obj->as<ArgumentsObject>().markLengthOverridden();
+        }
     }
 
     Rooted<PropertyDescriptor> desc(cx, desc_);