Bug 1310744: Don't enter in the fast path for DeleteArrayElement for frozen arrays. r=nbp

MozReview-Commit-ID: 6NuJICFchMr

--HG--
extra : rebase_source : af573290d89bc82a5c6e62a491fe29999aa4e3fb

js/src/jsarray.cpp

@@ -430,7 +430,9 @@ DeleteArrayElement(JSContext* cx, HandleObject obj, double index, ObjectOpResult
     MOZ_ASSERT(index >= 0);
     MOZ_ASSERT(floor(index) == index);
 
-    if (obj->is<ArrayObject>() && !obj->isIndexed()) {
+    if (obj->is<ArrayObject>() && !obj->isIndexed() &&
+        !obj->as<NativeObject>().denseElementsAreFrozen())
+    {
         ArrayObject* aobj = &obj->as<ArrayObject>();
         if (index <= UINT32_MAX) {
             uint32_t idx = uint32_t(index);