Fix Array.prototype.push and Array.prototype.unshift for read-only length.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 12f2ee0e5ce980e9009a80d944bb30a92a2b3828..217ef6ca6237c79e638b267a96951d6a34971ca0 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -10339,6 +10339,10 @@ class JSArray: public JSObject {
                                            uint32_t index,
                                            Handle<Object> value);
 
+  static bool IsReadOnlyLengthDescriptor(Handle<Map> jsarray_map);
+  static bool WouldChangeReadOnlyLength(Handle<JSArray> array, uint32_t index);
+  static MaybeHandle<Object> ReadOnlyLengthError(Handle<JSArray> array);
+
   // Initialize the array with the given capacity. The function may
   // fail due to out-of-memory situations, but only if the requested
   // capacity is non-zero.