Parent: #498 Related: #1052, #1053
Executed before changing code against Node and current zig-js tree/required-VM modes. An Array whose prototype is new String("abc") incorrectly creates own index 0 through the dense indexed creation gate. It overwrites the inherited readonly character and bypasses strict failure. The intrinsic push fast path does the same. Required bytecode also takes this path for canonical String keys.
Node result for numeric/sloppy, String/sloppy, numeric/strict, String/strict, and push is respectively:
[["a",false,0,false],["a",false,0,false],["a",false,0,true],["a",false,0,true],["a",false,0,true]]Tree mode incorrectly creates index 0 for numeric stores and push; required VM creates it in all five cases. String exotic character descriptors are virtual and do not set the Shape/dense indexed-presence flags used by the eligibility checks.
Acceptance:
- Reject String exotic ancestors in every shared array indexed-write/append eligibility check; retain the canonical OrdinarySet failure ordering.
- Pin numeric and String keys, sloppy/strict writes, UTF-16 character bounds, inherited hooks, mutation, and intrinsic push through tree/required-VM and no-JIT paths.
- Normal and unsuppressed TSan focused tests pass, including actual no-GIL use.
- Exact before/after relevant Array/String/Reflect corpus and tree/VM witnesses have no newly failing paths.
No throughput or global conformance-score claim is intended.