Try to switch Array builtins into strict mode.

test/mjsunit/object-freeze.js

Index: test/mjsunit/object-freeze.js
diff --git a/test/mjsunit/object-freeze.js b/test/mjsunit/object-freeze.js
index 3b7987402f8c91f466bcdd997f153873210f195a..4144936d06437396b5625f5a51493c45db42732d 100644
--- a/test/mjsunit/object-freeze.js
+++ b/test/mjsunit/object-freeze.js
@@ -322,13 +322,15 @@ Object.freeze(obj);
 // sufficient.
 assertTrue(Object.isSealed(obj));
 
-assertDoesNotThrow(function() { obj.push(); });
-assertDoesNotThrow(function() { obj.unshift(); });
-assertDoesNotThrow(function() { obj.splice(0,0); });
+// Verify that the length can't be written by builtins.
+assertThrows(function() { obj.push(); }, TypeError);
+assertThrows(function() { obj.unshift(); }, TypeError);
+assertThrows(function() { obj.splice(0,0); }, TypeError);
 assertTrue(Object.isFrozen(obj));
 
 // Verify that an item can't be changed with splice.
 assertThrows(function() { obj.splice(0,1,1); }, TypeError);
+assertTrue(Object.isFrozen(obj));
 
 // Verify that unshift() with no arguments will fail if it reifies from
 // the prototype into the object.