Bug 1312948: Revert "Bug 1310744: A frozen element has no writable length. r=nbp". r=nbp

These track two different concepts, and even though they're related, we
shouldn't stick them together this way.

MozReview-Commit-ID: EyM5MgrisX4
Signed-off-by: Emilio Cobos Álvarez <ecoal95@gmail.com>

js/src/jsarray.cpp

@@ -573,8 +573,7 @@ js::ArraySetLength(JSContext* cx, Handle<ArrayObject*> arr, HandleId id,
     {
         RootedShape lengthShape(cx, arr->lookupPure(id));
         MOZ_ASSERT(lengthShape);
-        MOZ_ASSERT_IF(lengthIsWritable, lengthShape->writable());
-        MOZ_ASSERT_IF(lengthShape->writable() && !lengthIsWritable, arr->denseElementsAreFrozen());
+        MOZ_ASSERT(lengthShape->writable() == lengthIsWritable);
     }
 #endif
     uint32_t oldLen = arr->length();

js/src/vm/NativeObject.h

@@ -228,8 +228,7 @@ class ObjectElements
         flags &= ~CONVERT_DOUBLE_ELEMENTS;
     }
     bool hasNonwritableArrayLength() const {
-        return flags & NONWRITABLE_ARRAY_LENGTH ||
-               flags & FROZEN;
+        return flags & NONWRITABLE_ARRAY_LENGTH;
     }
     void setNonwritableArrayLength() {
         MOZ_ASSERT(!isCopyOnWrite());