Bug 1312485: array: Don't optimize for dense storage if the elements are frozen. r=nbp

We're going to throw right away in most cases anyway.

MozReview-Commit-ID: 7YxAybEP1UQ

--HG--
extra : rebase_source : 984473b1f57d88e30d871147403422a5f9c6e6e8

js/src/jsarray.cpp

@@ -2382,6 +2382,10 @@ CanOptimizeForDenseStorage(HandleObject arr, uint32_t startingIndex, uint32_t co
     if (!arr->is<ArrayObject>() && !arr->is<UnboxedArrayObject>())
         return false;
 
+    /* If it's a frozen array, always pick the slow path */
+    if (arr->is<ArrayObject>() && arr->as<ArrayObject>().denseElementsAreFrozen())
+        return false;
+
     /*
      * Don't optimize if the array might be in the midst of iteration.  We
      * rely on this to be able to safely move dense array elements around with

js/src/tests/ecma_5/Array/frozen-dense-array.js

@@ -25,6 +25,7 @@ assertThrowsInstanceOf(() => a.splice(0, 1, 1), TypeError);
 assertThrowsInstanceOf(() => a.push("foo"), TypeError);
 assertThrowsInstanceOf(() => { "use strict"; a.length = 5; }, TypeError);
 assertThrowsInstanceOf(() => { "use strict"; delete a[0]; }, TypeError);
+assertThrowsInstanceOf(() => a.splice(Math.a), TypeError);
 
 // Shouldn't throw, since this is not strict mode, but shouldn't change the
 // value of the property.