Object.defineProperty(Array.prototype, 0, { writable: false }); [42].concat();
<rdar://problem/12357084> [REGRESSION] JSArray::putByIndex asserts with readonly property on prototype
Created attachment 165469 [details] the patch
Comment on attachment 165469 [details] the patch r=me
Landed in http://trac.webkit.org/changeset/129432