Fix broken tests, these 2 test cases were wrong:

- spread.js push wrote to arr[1] when proto was getter only
- bailOutOfMemOp.js push wrote to arr[5] when proto had writeable:false

test/es6/spread.js

@@ -1,5 +1,6 @@
 //-------------------------------------------------------------------------------------------------------
 // Copyright (C) Microsoft. All rights reserved.
+// Copyright (c) 2021 ChakraCore Project Contributors. All rights reserved.
 // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
 //-------------------------------------------------------------------------------------------------------
 
@@ -267,13 +268,15 @@ var tests = [
         Object.defineProperty(Array.prototype, 1, {
             get: function() {
                 x.length = 0;
-            }
+            },
+            configurable: true
         });
 
         var f = function(){
             assert.areEqual(arguments.length, 2, "Changing length of x during spreading should truncate the spread.");
         }
         f(...x);
+        delete Array.prototype[1];
     }
   },
   {

test/loop/bailOutOfMemOp.js

@@ -1,12 +1,13 @@
 //-------------------------------------------------------------------------------------------------------
 // Copyright (C) Microsoft. All rights reserved.
+// Copyright (c) 2021 ChakraCore Project Contributors. All rights reserved.
 // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
 //-------------------------------------------------------------------------------------------------------
 
 function f0() {
     var printArr = [];
     Object.prototype.m = {};
-    Object.defineProperty(Array.prototype, "5", {});
+    Object.defineProperty(Array.prototype, "5", {writable : true});
 
     for (var iterator = 0; iterator < 10; iterator++) {
         var arr0 = [];