Editorial: Don't allow writing NaN to frozen properties (#3404)

If an implementation can produce distinguishable NaN values, then
writing NaN values to a frozen (non-configurable and non-writable)
property can be detectable.

spec.html

@@ -12868,7 +12868,8 @@ <h1>
               1. If _Desc_ has a [[Set]] field and SameValue(_Desc_.[[Set]], _current_.[[Set]]) is *false*, return *false*.
             1. Else if _current_.[[Writable]] is *false*, then
               1. If _Desc_ has a [[Writable]] field and _Desc_.[[Writable]] is *true*, return *false*.
-              1. If _Desc_ has a [[Value]] field and SameValue(_Desc_.[[Value]], _current_.[[Value]]) is *false*, return *false*.
+              1. NOTE: SameValue returns *true* for *NaN* values which may be distinguishable by other means. Returning here ensures that any existing property of _O_ remains unmodified.
+              1. If _Desc_ has a [[Value]] field, return SameValue(_Desc_.[[Value]], _current_.[[Value]]).
           1. If _O_ is not *undefined*, then
             1. If IsDataDescriptor(_current_) is *true* and IsAccessorDescriptor(_Desc_) is *true*, then
               1. If _Desc_ has a [[Configurable]] field, let _configurable_ be _Desc_.[[Configurable]]; else let _configurable_ be _current_.[[Configurable]].