Bug 880591 - Properly track non-writable length in dictionary-mode arrays passed to Object.freeze.  r=bhackett, a=akeybl