Don't allow sets to readonly properties (bug 810925, r=kannan).

--HG--
extra : rebase_source : 2eac13774239d9047e7c869c4afab6eeef6f6502

js/src/ion/IonCaches.cpp

@@ -1302,7 +1302,7 @@ IsPropertyAddInlineable(JSContext *cx, HandleObject obj, jsid id, uint32_t oldSl
     if (obj->getClass()->resolve != JS_ResolveStub)
         return false;
 
-    if (!obj->isExtensible())
+    if (!obj->isExtensible() || !shape->writable())
         return false;
 
     // walk up the object prototype chain and ensure that all prototypes