Assume A is an Array object and P is a
string. When the [[Put]] method of A
is called with property P and value V,
the following steps are taken:
1. Call the [[CanPut]] method of A with name P.
2. If Result(1) is false, return.
3. If A doesn’t have a property with name P, go to step 7.
4. If P is “length”, go to step 12.
5. Set the value of property P of A to V.
6. Go to step 8.
7. Create a property with name P, set its value to V and give it empty
attributes.
8. If P is not an array index, return.
9. If ToUint32(P) is less than the value of the length property of A,
then return.
10. Change (or set) the value of the length property of A to ToUint32(P)+1.
11. Return.
12. Compute ToUint32(V).
13. If Result(12) is not equal to ToNumber(V), throw a RangeError
exception.
14. For every integer k that is less than the value of the length property
of A but not less than Result(12), if
A itself has a property (not an
inherited property) named ToString(k),
then delete that property.
– 98 -
15. Set the value of property P of A to Result(12).
16. Return.

可以看出，对于ToUint32(P)!=P的情况，只进行到8.就return了，不会改变A.length。
而10.中也可以看出，当ToUint32(P)>=A.length的时候，就改变A的length为ToUint32(P)+1了。

记住 JS 没有关联数组，就知道为何有 length 的误解了。你总结的第二点中实际上是要计算除了对象本身属性（ownProperty）外的 key/value pair 的数量。遗憾的是，JS 内置也没有相应的办法。

推荐你看：
http://andrewdupont.net/2006/05/18/javascript-associative-arrays-considered-harmful/