Reland ArrayPop / ArrayPush.

test/mjsunit/object-seal.js

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 233 matching lines @@
 
 %OptimizeFunctionOnNextCall(push_call);
 %OptimizeFunctionOnNextCall(shift_call);
 push_call(obj);
 shift_call(obj);
 assertOptimized(push_call);
 assertOptimized(shift_call);
 Object.seal(obj);
 assertThrows(function() { push_call(obj); }, TypeError);
 assertThrows(function() { shift_call(obj); }, TypeError);
-assertOptimized(push_call);
-// shift() doesn't have a custom call generator, so deopt will occur.
+assertUnoptimized(push_call);
 assertUnoptimized(shift_call);
 assertDoesNotThrow(function() { push_call(objControl); });
 assertDoesNotThrow(function() { shift_call(objControl); });
 
 // Verify special behavior of splice on sealed objects.
 obj = [1,2,3];
 Object.seal(obj);
 assertDoesNotThrow(function() { obj.splice(0,1,100); });
 assertEquals(100, obj[0]);
 assertDoesNotThrow(function() { obj.splice(0,2,1,2); });
 assertDoesNotThrow(function() { obj.splice(1,2,1,2); });
 // Count of items to delete is clamped by length.
 assertDoesNotThrow(function() { obj.splice(1,2000,1,2); });
 assertThrows(function() { obj.splice(0,0,1); }, TypeError);
 assertThrows(function() { obj.splice(1,2000,1,2,3); }, TypeError);