Numerous trivial bugs in Object.defineProperty

Numerous trivial bugs in Object.defineProperty
https://bugs.webkit.org/show_bug.cgi?id=78777

Reviewed by Sam Weinig.

There are a handful of really trivial bugs, related to Object.defineProperty:
    * Redefining an accessor with different attributes changes the attributes, but not the get/set functions!
    * Calling an undefined setter should only throw in strict mode.
    * When redefining an accessor to a data decriptor, if writable is not specified we should default to false.
    * Any attempt to redefine a non-configurable property of an array as configurable should be rejected.
    * Object.defineProperties should call toObject on 'Properties' argument, rather than throwing if it is not an object.
    * If preventExtensions has been called on an array, subsequent assignment beyond array bounds should fail.
    * 'isFrozen' shouldn't be checking the ReadOnly bit for accessor descriptors (we presently always keep this bit as 'false').
    * Should be able to redefine an non-writable, non-configurable property, with the same value and attributes.
    * Should be able to define an non-configurable accessor.
These are mostly all one-line changes, e.g. inverted boolean checks, masking against wrong attribute.

Source/JavaScriptCore:

* runtime/JSArray.cpp:
(JSC::SparseArrayValueMap::put):
    - Added ASSERT.
    - Calling an undefined setter should only throw in strict mode.
(JSC::JSArray::putDescriptor):
    - Should be able to define an non-configurable accessor.
(JSC::JSArray::defineOwnNumericProperty):
    - Any attempt to redefine a non-configurable property of an array as configurable should be rejected.
(JSC::JSArray::putByIndexBeyondVectorLength):
    - If preventExtensions has been called on an array, subsequent assignment beyond array bounds should fail.
* runtime/JSArray.h:
(JSArray):
    - made enterDictionaryMode public, called from JSObject.
* runtime/JSObject.cpp:
(JSC::JSObject::put):
    - Calling an undefined setter should only throw in strict mode.
(JSC::JSObject::preventExtensions):
    - Put array objects into dictionary mode to handle this!
(JSC::JSObject::defineOwnProperty):
    - Should be able to redefine an non-writable, non-configurable property, with the same value and attributes.
    - Redefining an accessor with different attributes changes the attributes, but not the get/set functions!
* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorDefineProperties):
    - Object.defineProperties should call toObject on 'Properties' argument, rather than throwing if it is not an object.
* runtime/PropertyDescriptor.cpp:
(JSC::PropertyDescriptor::attributesWithOverride):
    - When redefining an accessor to a data decriptor, if writable is not specified we should default to false.
(JSC::PropertyDescriptor::attributesOverridingCurrent):
    - When redefining an accessor to a data decriptor, if writable is not specified we should default to false.
* runtime/Structure.cpp:
(JSC::Structure::freezeTransition):
    - 'freezeTransition' shouldn't be setting the ReadOnly bit for accessor descriptors (we presently always keep this bit as 'false').
(JSC::Structure::isFrozen):
    - 'isFrozen' shouldn't be checking the ReadOnly bit for accessor descriptors (we presently always keep this bit as 'false').

LayoutTests:

* fast/js/Object-defineProperties-expected.txt:
* fast/js/Object-defineProperty-expected.txt:
* fast/js/preventExtensions-expected.txt:
* fast/js/property-getters-and-setters-expected.txt:
* fast/js/script-tests/Object-defineProperty.js:
* fast/js/script-tests/preventExtensions.js:
* fast/js/script-tests/property-getters-and-setters.js:
    - Update result & add new test cases for all bugs fixed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@107957 268f45cc-cd09-0410-ab3c-d52691b4dbfc