Array length reduction should throw in strict mode if it can't delete an element.

test/mjsunit/regress/regress-4267.js

Index: test/mjsunit/regress/regress-4267.js
diff --git a/test/mjsunit/regress/regress-4267.js b/test/mjsunit/regress/regress-4267.js
new file mode 100644
index 0000000000000000000000000000000000000000..f8cf7467230840416aa0ddb30bed01fb34d2e0f7
--- /dev/null
+++ b/test/mjsunit/regress/regress-4267.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+var a = [];
+Object.defineProperty(a, "0", {configurable: false, value: 10});
+assertEquals(1, a.length);
+var setter = ()=>{ a.length = 0; };
+assertThrows(setter);
+assertThrows(setter);
+%OptimizeFunctionOnNextCall(setter);
+assertThrows(setter);