Fixed bug in array filter and reduce functions.

test/test262/test262.status

 # Copyright 2011 the V8 project authors. All rights reserved.
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
 # met:
 #
 #     * Redistributions of source code must retain the above copyright
 #       notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above
 #       copyright notice, this list of conditions and the following
 #       disclaimer in the documentation and/or other materials provided
@@ skipping 1120 matching lines @@
 15.4.4.19-8-c-i-19: FAIL
 # Bug? Array.prototype.map - element changed by getter on previous iterations is
 #      observed on an Array
 15.4.4.19-8-c-i-28: FAIL
 # Bug? Array.prototype.filter applied to boolean primitive
 15.4.4.20-1-3: FAIL
 # Bug? Array.prototype.filter applied to number primitive
 15.4.4.20-1-5: FAIL
 # Bug? Array.prototype.filter applied to string primitive
 15.4.4.20-1-7: FAIL
-# Bug? Array.prototype.filter - value of 'length' is a number (value is
-#      negative)
-15.4.4.20-3-7: FAIL
-# Bug? Array.prototype.filter - value of 'length' is a number (value is
-#      Infinity)
-# V8 timeout
-15.4.4.20-3-8: SKIP
-# Bug? Array.prototype.filter - 'length' is a string containing a negative
-#      number
-15.4.4.20-3-12: FAIL
-# Bug? Array.prototype.filter - 'length' is a string containing a decimal number
-15.4.4.20-3-13: FAIL
-# Bug? Array.prototype.filter - 'length' is a string containing +/-Infinity
-15.4.4.20-3-14: SKIP
-# Bug? Array.prototype.filter - value of 'length' is a positive non-integer,
-#      ensure truncation occurs in the proper direction
-# V8 timeout
-15.4.4.20-3-24: FAIL
-# Bug? Array.prototype.filter - value of 'length' is a negative non-integer,
-#      ensure truncation occurs in the proper direction
-15.4.4.20-3-25: FAIL
-# Bug? Array.prototype.filter - value of 'length' is boundary value (2^32)
-# V8 timeout
-15.4.4.20-3-28: SKIP
-# Bug? Array.prototype.filter - value of 'length' is boundary value (2^32 + 1)
-# V8 timeout
-15.4.4.20-3-29: SKIP
 # Bug? Array.prototype.filter - side effects produced by step 2 are visible when
 #      an exception occurs
 15.4.4.20-4-8: FAIL
 # Bug? Array.prototype.filter - side effects produced by step 3 are visible when
 #      an exception occurs
 15.4.4.20-4-9: FAIL
 # Bug? Array.prototype.filter - the exception is not thrown if exception was
 #      thrown by step 2
 15.4.4.20-4-10: FAIL
 # Bug? Array.prototype.filter - the exception is not thrown if exception was
@@ skipping 35 matching lines @@
 15.4.4.20-9-c-i-22: FAIL
 # Bug? Array.prototype.filter - element changed by getter on previous iterations
 #      is observed on an Array
 15.4.4.20-9-c-i-28: FAIL
 # Bug? Array.prototype.reduce applied to boolean primitive
 15.4.4.21-1-3: FAIL
 # Bug? Array.prototype.reduce applied to number primitive
 15.4.4.21-1-5: FAIL
 # Bug? Array.prototype.reduce applied to string primitive
 15.4.4.21-1-7: FAIL
-# Bug? Array.prototype.reduce - value of 'length' is a number (value is
-#      negative)
-15.4.4.21-3-7: FAIL
-# Bug? Array.prototype.reduce - value of 'length' is a number (value is
-#      Infinity)
-# V8 timeout.
-15.4.4.21-3-8: SKIP
-# Bug? Array.prototype.reduce - 'length' is a string containing a negative
-#      number
-15.4.4.21-3-12: FAIL
-# Bug? Array.prototype.reduce - 'length' is a string containing a decimal number
-15.4.4.21-3-13: FAIL
-# Bug? Array.prototype.reduce - 'length' is a string containing +/-Infinity
-# V8 timeout.
-15.4.4.21-3-14: SKIP
-# Bug? Array.prototype.reduce - value of 'length' is a positive non-integer,
-#      ensure truncation occurs in the proper direction
-15.4.4.21-3-24: FAIL
-# Bug? Array.prototype.reduce - value of 'length' is a negative non-integer,
-#      ensure truncation occurs in the proper direction
-15.4.4.21-3-25: FAIL
-# Bug? Array.prototype.reduce - value of 'length' is boundary value (2^32)
-# V8 timeout.
-15.4.4.21-3-28: SKIP
-# Bug? Array.prototype.reduce - value of 'length' is boundary value (2^32 + 1)
-# V8 timeout.
-15.4.4.21-3-29: SKIP
 # Bug? Array.prototype.reduce - side effects produced by step 2 are visible when
 #      an exception occurs
 15.4.4.21-4-8: FAIL
 # Bug? Array.prototype.reduce - side effects produced by step 3 are visible when
 #      an exception occurs
 15.4.4.21-4-9: FAIL
 # Bug? Array.prototype.reduce - the exception is not thrown if exception was
 #      thrown by step 2
 15.4.4.21-4-10: FAIL
 # Bug? Array.prototype.reduce - the exception is not thrown if exception was
 #      thrown by step 3
 15.4.4.21-4-11: FAIL
 # Bug? Array.prototype.reduce - calling with no callbackfn is the same as
 #      passing undefined for callbackfn
 15.4.4.21-4-15: FAIL
 # Bug? Array.prototype.reduce - decreasing length of array in step 8 does not
 #      delete non-configurable properties
 15.4.4.21-9-b-16: FAIL
 # Bug? Array.prototype.reduce - decreasing length of array does not delete
 #      non-configurable properties
 15.4.4.21-9-b-29: FAIL
 # Bug? Array.prototype.reduceRight applied to boolean primitive
 15.4.4.22-1-3: FAIL
 # Bug? Array.prototype.reduceRight applied to number primitive
 15.4.4.22-1-5: FAIL
 # Bug? Array.prototype.reduceRight applied to string primitive
 15.4.4.22-1-7: FAIL
-# Bug? Array.prototype.reduceRight - value of 'length' is a number (value is
-#      negative)
-15.4.4.22-3-7: FAIL
-# Bug? Array.prototype.reduceRight - value of 'length' is a number (value is
-#      Infinity)
-# V8 timeout.
-15.4.4.22-3-8: SKIP
-# Bug? Array.prototype.reduceRight - value of 'length' is a string containing a
-#      negative number
-15.4.4.22-3-12: FAIL
-# Bug? Array.prototype.reduceRight - value of 'length' is a string containing a
-#      decimal number
-15.4.4.22-3-13: FAIL
-# Bug? Array.prototype.reduceRight - value of 'length' is a string containing
-#      +/-Infinity
-# V8 timeout.
-15.4.4.22-3-14: SKIP
-# Bug? Array.prototype.reduceRight - value of 'length' is a positive
-#      non-integer, ensure truncation occurs in the proper direction
-15.4.4.22-3-24: FAIL
-# Bug? Array.prototype.reduceRight - value of 'length' is a negative
-#      non-integer, ensure truncation occurs in the proper direction
-15.4.4.22-3-25: FAIL
-# Bug? Array.prototype.reduceRight - value of 'length' is boundary value (2^32)
-# V8 timeout.
-15.4.4.22-3-28: SKIP
-# Bug? Array.prototype.reduceRight - value of 'length' is boundary value (2^32 +
-#      1)
-# V8 timeout.
-15.4.4.22-3-29: SKIP
 # Bug? Array.prototype.reduceRight - side effects produced by step 2 are visible
 #      when an exception occurs
 15.4.4.22-4-8: FAIL
 # Bug? Array.prototype.reduceRight - side effects produced by step 3 are visible
 #      when an exception occurs
 15.4.4.22-4-9: FAIL
 # Bug? Array.prototype.reduceRight - the exception is not thrown if exception
 #      was thrown by step 2
 15.4.4.22-4-10: FAIL
 # Bug? Array.prototype.reduceRight - the exception is not thrown if exception
@@ skipping 112 matching lines @@
 #      values (false)
 15.10.7.4-2: FAIL
 # Bug? RegExp.prototype.lastIndex is of type Number
 15.10.7.5-1: FAIL
 # Bug? RegExp.prototype.lastIndex is a data property with specified attribute
 #      values
 15.10.7.5-2: FAIL
 # Bug? Error.prototype.toString return the value of 'msg' when 'name' is empty
 #      string and 'msg' isn't undefined
 15.11.4.4-8-1: FAIL