Bug 1310744: Bail out from SetOrExtendBoxedOrUnboxedDenseElements if the elements are frozen. r=nbp

MozReview-Commit-ID: 9INusCjjn9K

--HG--
extra : rebase_source : 1d05ed737cf8d37b3a4f7d71f95492b41f0b8f87

js/src/vm/UnboxedObject-inl.h

@@ -478,6 +478,9 @@ SetOrExtendBoxedOrUnboxedDenseElements(ExclusiveContext* cx, JSObject* obj,
     if (Type == JSVAL_TYPE_MAGIC) {
         NativeObject* nobj = &obj->as<NativeObject>();
 
+        if (nobj->denseElementsAreFrozen())
+            return DenseElementResult::Incomplete;
+
         if (obj->is<ArrayObject>() &&
             !obj->as<ArrayObject>().lengthIsWritable() &&
             start + count >= obj->as<ArrayObject>().length())