Fix: KeyedStoreGeneric must check for writable array length

src/builtins/builtins-array.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins.h"
 #include "src/builtins/builtins-utils.h"
 
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/contexts.h"
@@ skipping 221 matching lines @@
     assembler.Comment(
         "Disallow pushing onto arrays in dictionary named property mode");
     assembler.GotoIf(assembler.IsDictionaryMap(map), &runtime);
 
     // Check whether the length property is writable. The length property is the
     // only default named property on arrays. It's nonconfigurable, hence is
     // guaranteed to stay the first property.
     Node* descriptors = assembler.LoadMapDescriptors(map);
     Node* details = assembler.LoadFixedArrayElement(
         descriptors, DescriptorArray::ToDetailsIndex(0));
-    mask = READ_ONLY << PropertyDetails::AttributesField::kShift;
+    mask = PropertyDetails::kAttributesReadOnlyMask;
     Node* mask_node = assembler.SmiConstant(mask);
     test = assembler.SmiAnd(details, mask_node);
     assembler.GotoIf(assembler.WordEqual(test, mask_node), &runtime);
 
     arg_index.Bind(assembler.IntPtrConstant(0));
     kind = assembler.DecodeWord32<Map::ElementsKindBits>(bit_field2);
 
     assembler.GotoIf(
         assembler.Int32GreaterThan(
             kind, assembler.Int32Constant(FAST_HOLEY_SMI_ELEMENTS)),
@@ skipping 2493 matching lines @@
     Node* message = assembler.SmiConstant(MessageTemplate::kDetachedOperation);
     Node* result =
         assembler.CallRuntime(Runtime::kThrowTypeError, context, message,
                               assembler.HeapConstant(operation));
     assembler.Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8