Use SetOwnElement when creating splice records in array length setter

Use SetOwnElement when creating splice records in array length setter

This avoids touching the Array prototype, which may have been tampered with.

BUG=chromium:443982
LOG=n

Committed: https://crrev.com/1f1329d960fcd8bb21223cb0ed0825f9c5e89e21
Cr-Commit-Position: refs/heads/master@{#25908}

[adamk, 2014-12-19 19:05:05]

adamk@chromium.org changed reviewers:
+ arv@chromium.org

[arv (Not doing code reviews), 2014-12-19 19:17:52]

LGTM

[adamk, 2014-12-19 19:18:11]

The CQ bit was checked by adamk@chromium.org

[commit-bot: I haz the power, 2014-12-19 19:19:06]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/820503005/1

[commit-bot: I haz the power, 2014-12-19 19:39:28]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2014-12-19 19:39:48]

Patchset 1 (id:??) landed as
https://crrev.com/1f1329d960fcd8bb21223cb0ed0825f9c5e89e21
Cr-Commit-Position: refs/heads/master@{#25908}