Fix ArrayLengthSetter to not throw on non-extensible receivers.

src/accessors.cc

Index: src/accessors.cc
diff --git a/src/accessors.cc b/src/accessors.cc
index cc7c22e223b52bce6a06c7dfc4a6c8001c5a7e63..702343778ae756a2a92f5ce19363f9d13581f242 100644
--- a/src/accessors.cc
+++ b/src/accessors.cc
@@ -174,13 +174,16 @@ void Accessors::ArrayLengthSetter(
     const v8::PropertyCallbackInfo<void>& info) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
   HandleScope scope(isolate);
-  Handle<JSObject> object = Handle<JSObject>::cast(
-      Utils::OpenHandle(*info.This()));
+  Handle<JSObject> object = Utils::OpenHandle(*info.This());
   Handle<Object> value = Utils::OpenHandle(*val);
   // This means one of the object's prototypes is a JSArray and the
   // object does not have a 'length' property.  Calling SetProperty
   // causes an infinite loop.
   if (!object->IsJSArray()) {
+    // This behaves sloppy since we lost the actual strict-mode.
+    // TODO(verwaest): Fix by making ExecutableAccessorInfo behave like data
+    // properties.
+    if (!object->map()->is_extensible()) return;
     MaybeHandle<Object> maybe_result = JSObject::SetOwnPropertyIgnoreAttributes(
         object, isolate->factory()->length_string(), value, NONE);
     maybe_result.Check();