Fixed Array.prototype.reverse() behavior when array is frozen or array elements are not writable an…

test/mjsunit/sparse-array-reverse.js

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 111 matching lines @@
     a.reverse();
 
     while (to_delete.length != 0) {
       var pos = to_delete.pop();
       delete(Array.prototype[pos]);
     }
 
     assertEquals(expected_reversed2 + expected_reversed, a.join(''), 'reverse then join' + size);
   }
 }
+
+
+function GetSparseArray() {
+  var a = [];
+  a.length = 2000;
+  a[15] = 'a';
+  a[30] = 'b';
+  a[40] = 'c';
+  a[1959] = 'd';
+  a[1999] = 'e';
+  
+  return a;
+}
+
+var tests = [
+  "a.reverse()",
+  "Array.prototype.reverse.call(a)",
+  "Array.prototype.reverse.apply(a)"
+];
+
+for (var i = 0; i < tests; i++) {
+  var a = GetSparseArray();
+  a[1000] = '1';
+  Object.defineProperty(a, 1000, {configurable: false});
+  assertThrows(tests[i], TypeError);
+}
+
+for (var i = 0; i < tests; i++) {
+  var a = GetSparseArray();
+  Object.defineProperty(a, 0, {writable: false});
+  assertThrows(tests[i], TypeError);
+}
+
+for (var i = 0; i < tests; i++) {
+  var a = GetSparseArray();
+  Object.freeze(a);
+  assertThrows(tests[i], TypeError);
+}
+
+for (var i = 0; i < tests; i++) {
+  var a = [1, 2, 3];
+  Object.defineProperty(a, 0, {writable: false});
+}
+
+for (var i = 0; i < tests; i++) {
+  var a = [1, 2, , 4];
+  Object.defineProperty(a, 1, {configurable: false});
+  assertThrows(tests[i], TypeError);
+}
+
+for (var i = 0; i < tests; i++) {
+  var a = [1, 2, 3];
+  Object.freeze(a);
+  assertThrows(tests[i], TypeError);
+}