[].push wrt properties along the [[Prototype]] chain

[Jeff Walden]

Consider:

  Object.defineProperty(Object.prototype, "0", { value: 17, writable: false, configurable: false });
  [].push(42);

Per ES5, I think this is supposed to throw a TypeError.  The push should be setting property "0" with Throw = true, which means that when [[CanPut]] fails, a TypeError gets thrown.  No engine I can test does this, I suspect because everyone's mis-implemented an optimization.

On IRC it was pointed out that http://wiki.ecmascript.org/doku.php?id=strawman:fixing_override_mistake is supposed to fix this: you should be able to shadow a non-writable property on a prototype.  Or something.  But there's contention there about this not actually being a mistake.  (I think that contention's probably right, for what it's worth, but I digress.)

But suppose it isn't, for the moment.  What then of this:

  Object.defineProperty(Object.prototype, 0, { set: function() { throw "FAIL"; } });
  [].push(42)

I think this should throw, again because it's *setting* property "0".  But again, no engine I can test actually throws for this.

My gut says this is a case where every engine attempted to optimize, and optimized wrongly such that incorrect semantics resulted.  The question is, since no engine's following the spec, whether the spec should change, the engines should change, or what.  Given that indexed properties on Array.prototype and Object.prototype are not something anyone sane does, I tend to think changing it to [[DefineOwnProperty]] would be good.  But maybe the spec really should win, and everyone should change.  I dunno.  Please sort this out!  :-)

Jeff