Object.oberve: assertions to narrow down flaky crashes with array length mutation.

test/mjsunit/harmony/object-observe.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 925 matching lines @@
     var count = oldSize > newSize ? oldSize - newSize : 0;
     observer.assertRecordCount(count + 1);
     var lengthRecord = observer.records[count];
     assertSame(arr, lengthRecord.object);
     assertEquals('length', lengthRecord.name);
     assertEquals('updated', lengthRecord.type);
     assertSame(oldSize, lengthRecord.oldValue);
   }
 }
 
-// TODO(rossberg): Still flaky on buildbots, disable for now...
-/*
 for (var b1 = 0; b1 < 2; ++b1)
   for (var b2 = 0; b2 < 2; ++b2)
     for (var n1 = 0; n1 < 3; ++n1)
       for (var n2 = 0; n2 < 3; ++n2)
         TestFastElementsLength(b1 != 0, b2 != 0, 20*n1, 20*n2);
-*/