Use premordial Object.isSealed/isFrozen in builtins.

test/mjsunit/regress/regress-builtinbust-1.js

Index: test/mjsunit/regress/regress-builtinbust-1.js
diff --git a/test/mjsunit/neuter-twice.js b/test/mjsunit/regress/regress-builtinbust-1.js
similarity index 57%
copy from test/mjsunit/neuter-twice.js
copy to test/mjsunit/regress/regress-builtinbust-1.js
index 3501cee4330f966c1eeaf6f5b7ebdc6418f2bcec..947766cbccf94e24eb1589d8aeaba0b4eecfdb1a 100644
--- a/test/mjsunit/neuter-twice.js
+++ b/test/mjsunit/regress/regress-builtinbust-1.js
@@ -1,9 +1,9 @@
 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --allow-natives-syntax
 
-var ab = new ArrayBuffer(100);
-%ArrayBufferNeuter(ab);
-%ArrayBufferNeuter(ab);
+function nope() { return false; }
+var a = [ 1, 2, 3 ];
+Object.seal(a);
+Object.isSealed = nope;
+assertThrows("a.shift()");

[mvstanton, 2014/04/03 08:05:24]

I guess here is the full list of breakers:

assertThrows(function() { a.shift(); }, TypeError);
assertThrows(function() { a.pop(); }, TypeError);
assertThrows(function() { a.push(5); }, TypeError);
assertThrows(function() { a.unshift(5); }, TypeError);
assertThrows(function() { a.splice(0, 1); }, TypeError);

[Michael Starzinger, 2014/04/03 08:11:28]

Done. Added the asserts.