Bug 866580 - Assertion redefining the length property on a frozen array.  r=bhackett

--HG--
extra : rebase_source : 8bba3b33a92ef41738bfd465e6cc101189220ecb
Bug 866700 - Assertion when redefining a non-writable length to a non-numeric value.  r=bhackett