The problem is that we use js_NativeGet and hence have to stick to native objects. This is a remaining unfixed case from bug 434837. At the time we had no way to fix, but now we do.
Created attachment 571883 [details] [diff] [review]
When forwarding property gets to the proto for arrays, send along the right receiver even if the property lives on a non-native object.
As I noted on IRC, this patch demonstrates one reason why we should make getOwnProperty, in some form, the fundamental property-get operation. Every one of these methods has to hard-code the property-delegation lookup process, and every one has to be fixed if a bug is found, as here. I started this in bug 637378 half a year ago and hit a nontrivial XBL-based snag. Perhaps we should go back and beat XBL into submission so we could move further in that direction...