Merge a number of assertion failure fixes to the 3.0 branch.

test/mjsunit/getter-in-prototype.js

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 13 matching lines @@
 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Test that exceptions are thrown when setting properties on object
 // that have only a getter in a prototype object.
 
 var o = {};
 var p = {};
 p.__defineGetter__('x', function(){});
+p.__defineGetter__(0, function(){});
 o.__proto__ = p;
 
 assertThrows("o.x = 42");
+assertThrows("o[0] = 42");
 
 function f() {
   with(o) {
     x = 42;
   }
 }
 assertThrows("f()");
 
 __proto__ = p;
 function g() {
   eval('1');
   x = 42;
 }
 assertThrows("g()");
+
+__proto__ = p;
+function g2() {
+  this[0] = 42;
+}
+assertThrows("g2()");