Fix return value of push() and unshift() on Array.prototype.

src/array.js

Index: src/array.js
diff --git a/src/array.js b/src/array.js
index d158a059c678019ef2460f142eabc2e252ef4754..b3b25ed260c505f35c058c0cdabd8e8b9b8c057c 100644
--- a/src/array.js
+++ b/src/array.js
@@ -444,13 +444,14 @@ function ObservedArrayPush() {
     for (var i = 0; i < m; i++) {
       this[i+n] = %_Arguments(i);
     }
-    this.length = n + m;
+    var new_length = n + m;
+    this.length = new_length;
   } finally {
     EndPerformSplice(this);
     EnqueueSpliceRecord(this, n, [], m);
   }
 
-  return this.length;
+  return new_length;
 }
 
 // Appends the arguments to the end of the array and returns the new
@@ -471,8 +472,10 @@ function ArrayPush() {
   for (var i = 0; i < m; i++) {
     this[i+n] = %_Arguments(i);
   }
-  this.length = n + m;
-  return this.length;
+
+  var new_length = n + m;
+  this.length = new_length;
+  return new_length;
 }
 
 
@@ -627,13 +630,14 @@ function ObservedArrayUnshift() {
     for (var i = 0; i < num_arguments; i++) {
       this[i] = %_Arguments(i);
     }
-    this.length = len + num_arguments;
+    var new_length = len + num_arguments;
+    this.length = new_length;
   } finally {
     EndPerformSplice(this);
     EnqueueSpliceRecord(this, 0, [], num_arguments);
   }
 
-  return len + num_arguments;
+  return new_length;
 }
 
 function ArrayUnshift(arg1) {  // length == 1
@@ -672,9 +676,9 @@ function ArrayUnshift(arg1) {  // length == 1
     this[i] = %_Arguments(i);
   }
 
-  this.length = len + num_arguments;
-
-  return this.length;
+  var new_length = len + num_arguments;
+  this.length = new_length;
+  return new_length;
 }