Fix Array.prototype.push and Array.prototype.unshift for read-only length.

src/array.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 "use strict";
 
 // This file relies on the fact that the following declarations have been made
 // in runtime.js:
 // var $Array = global.Array;
 
@@ skipping 585 matching lines @@
 
   return first;
 }
 
 function ObservedArrayUnshift() {
   var len = TO_UINT32(this.length);
   var num_arguments = %_ArgumentsLength();
 
   try {
     BeginPerformSplice(this);
-    SimpleMove(this, 0, 0, len, num_arguments);
+    if (len > 0) {
+      SimpleMove(this, 0, 0, len, num_arguments);
+    }
     for (var i = 0; i < num_arguments; i++) {
       this[i] = %_Arguments(i);
     }
     var new_length = len + num_arguments;
     this.length = new_length;
   } finally {
     EndPerformSplice(this);
     EnqueueSpliceRecord(this, 0, [], num_arguments);
   }
 
   return new_length;
 }
 
 function ArrayUnshift(arg1) {  // length == 1
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.unshift");
 
   if (%IsObserved(this))
     return ObservedArrayUnshift.apply(this, arguments);
 
   var array = TO_OBJECT_INLINE(this);
   var len = TO_UINT32(array.length);
   var num_arguments = %_ArgumentsLength();
   var is_sealed = ObjectIsSealed(array);
 
-  if (IS_ARRAY(array) && !is_sealed) {
-    SmartMove(array, 0, 0, len, num_arguments);
-  } else {
-    SimpleMove(array, 0, 0, len, num_arguments);
+  if (len > 0) {
+    if (IS_ARRAY(array) && !is_sealed) {
+      SmartMove(array, 0, 0, len, num_arguments);
+    } else {
+      SimpleMove(array, 0, 0, len, num_arguments);
+    }
   }
 
   for (var i = 0; i < num_arguments; i++) {
     array[i] = %_Arguments(i);
   }
 
   var new_length = len + num_arguments;
   array.length = new_length;
   return new_length;
 }
@@ skipping 880 matching lines @@
   ));
 
   SetUpLockedPrototype(InternalPackedArray, $Array(), $Array(
     "join", getFunction("join", ArrayJoin),
     "pop", getFunction("pop", ArrayPop),
     "push", getFunction("push", ArrayPush)
   ));
 }
 
 SetUpArray();