Don't use StoreIC_ArrayLength on frozen arrays

test/mjsunit/regress/regress-2711.js

Index: test/mjsunit/regress/regress-2711.js
diff --git a/test/mjsunit/regress/regress-235311.js b/test/mjsunit/regress/regress-2711.js
similarity index 90%
copy from test/mjsunit/regress/regress-235311.js
copy to test/mjsunit/regress/regress-2711.js
index 300714718f75e3ab084687af21aa1bf145e16678..a58e789745bc34289711ebe56270735631345b5e 100644
--- a/test/mjsunit/regress/regress-235311.js
+++ b/test/mjsunit/regress/regress-2711.js
@@ -25,8 +25,9 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-var new_space_string = "";
-for (var i = 0; i < 12800; ++i) {
-  new_space_string +=
-      String.fromCharCode(Math.random() * 26 + (4294967295) | 0);
-}
+// Test that frozen arrays don't let their length change
+var a = Object.freeze([1]);
+a.push(2);

[ihab.awad, 2013/07/12 20:41:29]

Fwiw, my testing on 30.0.1562.0 canary showed that:

  aFrozenArray.push(2);

respected frozen-ness, but, enigmatically:

  Array.prototype.push.call(aFrozenArray, 2);

did *not* respect frozen-ness; it bumped the 'length' property but did not
actually insert an element into the array.

+assertEquals(1, a.length);
+a.push(2);
+assertEquals(1, a.length);