Fixed spec violation of storing to length of a frozen object.

src/stub-cache.h

Index: src/stub-cache.h
diff --git a/src/stub-cache.h b/src/stub-cache.h
index f6528c8535ab1823a00dca1f96836ea8f42b291d..7a304fe71aef1f287e41a0690a432cb41967be6e 100644
--- a/src/stub-cache.h
+++ b/src/stub-cache.h
@@ -679,6 +679,12 @@ class StoreStubCompiler: public BaseLoadStoreStubCompiler {
                                  LookupResult* lookup,
                                  Handle<Name> name);
 
+  Handle<Code> CompileStoreArrayLength(Handle<JSObject> object,
+                                       LookupResult* lookup,
+                                       Handle<Name> name);
+
+  void GenerateStoreArrayLength();
+
   void GenerateNegativeHolderLookup(MacroAssembler* masm,
                                     Handle<JSObject> holder,
                                     Register holder_reg,