[array] Use Array.p.fill baseline version if object is non-extensible

This CL fixes a bug where a fast-path was used on non-extensible
objects.

R=jgruber@chromium.org

Bug: chromium:865264,chromium:865285
Change-Id: Ie14c95b383a65576799c71576a5c0f9f8e1c29ca
Reviewed-on: https://chromium-review.googlesource.com/1142766Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#54539}

src/builtins/builtins-array.cc

@@ -238,7 +238,8 @@ V8_WARN_UNUSED_RESULT bool TryFastArrayFill(
       HandleScope scope(isolate);
       JSObject::TransitionElementsKind(array, PACKED_ELEMENTS);
     }
-  } else if (!HasOnlySimpleReceiverElements(isolate, *object)) {
+  } else if (!HasOnlySimpleReceiverElements(isolate, *object) ||
+             !object->map()->is_extensible()) {
     return false;
   }
 

test/mjsunit/es6/array-fill.js

@@ -109,3 +109,19 @@ function TestFillObjectWithPrototypeAccessors() {
   }
 }
 TestFillObjectWithPrototypeAccessors();
+
+function TestFillSealedObject() {
+  let object = { length: 42 };
+  Object.seal(object);
+
+  assertThrows(() => Array.prototype.fill.call(object), TypeError);
+}
+TestFillSealedObject();
+
+function TestFillFrozenObject() {
+  let object = { length: 42 };
+  Object.freeze(object);
+
+  assertThrows(() => Array.prototype.fill.call(object), TypeError);
+}
+TestFillFrozenObject();