Fix Array.prototype.push and Array.prototype.unshift for read-only length.

src/array.js

Index: src/array.js
diff --git a/src/array.js b/src/array.js
index dcaf0f40080e84db790321726bd9c67244eca5be..6f649e1f39bfe7dd7e8f8b8508ede2e35ab4d632 100644
--- a/src/array.js
+++ b/src/array.js
@@ -603,7 +603,9 @@ function ObservedArrayUnshift() {
 
   try {
     BeginPerformSplice(this);
-    SimpleMove(this, 0, 0, len, num_arguments);
+    if (len > 0) {
+      SimpleMove(this, 0, 0, len, num_arguments);
+    }
     for (var i = 0; i < num_arguments; i++) {
       this[i] = %_Arguments(i);
     }
@@ -628,10 +630,12 @@ function ArrayUnshift(arg1) {  // length == 1
   var num_arguments = %_ArgumentsLength();
   var is_sealed = ObjectIsSealed(array);
 
-  if (IS_ARRAY(array) && !is_sealed) {
-    SmartMove(array, 0, 0, len, num_arguments);
-  } else {
-    SimpleMove(array, 0, 0, len, num_arguments);
+  if (len > 0) {
+    if (IS_ARRAY(array) && !is_sealed) {
+      SmartMove(array, 0, 0, len, num_arguments);
+    } else {
+      SimpleMove(array, 0, 0, len, num_arguments);
+    }
   }
 
   for (var i = 0; i < num_arguments; i++) {