Array builtins proceed blithely on frozen arrays

Array builtins need to be prevented from changing frozen objects, and changing structure on sealed objects.

BUG=299979
LOG=Y
R=verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=18164

[mvstanton, 2013-11-21 13:35:55]

Hi guys, PTAL.
Thanks,
--Michael

[Toon Verwaest, 2013-11-21 13:44:02]

I think we should check for sealed objects, not frozen.

[mvstanton, 2013-11-25 15:50:15]

Hi, I've updated to rely on sealed, only paying attention to frozen in
array.splice(), where we may simply change existing elements. PTAL, thanks,
--michael

[Toon Verwaest, 2013-11-25 16:01:10]

Looking good. Go ahead with the platform ports.

[mvstanton, 2013-11-25 20:28:01]

Okay, here are the ports, thanks!
--michael

[Toon Verwaest, 2013-11-28 19:06:27]

lgtm

[mvstanton, 2013-11-29 15:22:28]

Committed patchset #6 manually as r18164 (presubmit successful).