diff -r 000000000000 -r 6474c204b198 js/src/tests/ecma_5/JSON/stringify-replacer-array-hijinks.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/tests/ecma_5/JSON/stringify-replacer-array-hijinks.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,59 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+var gTestfile = 'stringify-replacer-array-hijinks.js';
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 648471;
+var summary =
+  "Better/more correct handling for replacer arrays with getter array index " +
+  "properties";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+var replacer = [0, 1, 2, 3];
+Object.prototype[3] = 3;
+Object.defineProperty(replacer, 1, {
+  get: function()
+  {
+    Object.defineProperty(replacer, 4, { value: 4 });
+    delete replacer[2];
+    delete replacer[3];
+    replacer[5] = 5;
+    return 1;
+  }
+});
+
+var s =
+  JSON.stringify({0: { 1: { 3: { 4: { 5: { 2: "omitted" } } } } } }, replacer);
+
+// The replacer array's length is as seen on first query, so property names are
+// accumulated for indexes i ∈ {0, 1, 2, 3}, but index 1 deletes 2 and 3, so 2
+// isn't seen but 3 is seen as Object.prototype[3].
+assertEq('{"0":{"1":{"3":{"3":3}},"3":3},"3":3}', s);
+
+
+var replacer = [0, 1, 2, 3];
+Object.defineProperty(replacer, 0, {
+  get: function()
+  {
+    replacer.length = 0;
+    return {};
+  }
+});
+
+// The replacer.length truncation means only properties on the prototype chain
+// shine through, but it doesn't affect the original bounds of the iteration
+// used to determine property names which will be included in the final string.
+assertEq(JSON.stringify({ 0: 0, 1: 1, 2: 2, 3: 3 }, replacer),
+         '{"3":3}');
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");