When freezing global object, go through the property cell

test/mjsunit/regress/regress-global-freeze-const.js

Index: test/mjsunit/regress/regress-global-freeze-const.js
diff --git a/test/mjsunit/regress/regress-355485.js b/test/mjsunit/regress/regress-global-freeze-const.js
similarity index 67%
copy from test/mjsunit/regress/regress-355485.js
copy to test/mjsunit/regress/regress-global-freeze-const.js
index 3c66884c000dd5860b2bd9c82705f7a58afb28ae..0b9e1f3ebd4bb79c00db30a7b33e450e5bfe68a0 100644
--- a/test/mjsunit/regress/regress-355485.js
+++ b/test/mjsunit/regress/regress-global-freeze-const.js
@@ -2,4 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-assertEquals("\u039c", "\u00b5".toUpperCase());
+__defineSetter__('x', function() { });
+Object.freeze(this);
+eval('const x = 1');