Fix Array.prototype.push and Array.prototype.unshift for read-only length.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "hydrogen.h"
 
 #include <algorithm>
 
 #include "v8.h"
 #include "allocation-site-scopes.h"
@@ skipping 7771 matching lines @@
 
       ast_context()->ReturnValue(result);
       return true;
     }
     case kArrayPush: {
       if (receiver_map.is_null()) return false;
       if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
       ElementsKind elements_kind = receiver_map->elements_kind();
       if (!IsFastElementsKind(elements_kind)) return false;
       if (receiver_map->is_observed()) return false;
+      if (JSArray::IsReadOnlyLengthDescriptor(receiver_map)) return false;
       ASSERT(receiver_map->is_extensible());
 
       // If there may be elements accessors in the prototype chain, the fast
       // inlined version can't be used.
       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
       // If there currently can be no elements accessors on the prototype chain,
       // it doesn't mean that there won't be any later. Install a full prototype
       // chain check to trap element accessors being installed on the prototype
       // chain, which would cause elements to go to dictionary mode and result
       // in a map change.
@@ skipping 3871 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal