Merge a number of assertion failure fixes to the 3.0 branch.

test/mjsunit/getter-in-prototype.js

Index: test/mjsunit/getter-in-prototype.js
===================================================================
--- test/mjsunit/getter-in-prototype.js	(revision 6703)
+++ test/mjsunit/getter-in-prototype.js	(working copy)
@@ -31,9 +31,11 @@
 var o = {};
 var p = {};
 p.__defineGetter__('x', function(){});
+p.__defineGetter__(0, function(){});
 o.__proto__ = p;
 
 assertThrows("o.x = 42");
+assertThrows("o[0] = 42");
 
 function f() {
   with(o) {
@@ -48,3 +50,9 @@
   x = 42;
 }
 assertThrows("g()");
+
+__proto__ = p;
+function g2() {
+  this[0] = 42;
+}
+assertThrows("g2()");