Fix Array.prototype.push and Array.prototype.unshift for read-only length.

src/array.js

Index: src/array.js
diff --git a/src/array.js b/src/array.js
index 5b036e6db41ce76926ca3cd2e070b00ff2b5b390..60a4025c017c370d482cd5906501016b61e125ee 100644
--- a/src/array.js
+++ b/src/array.js
@@ -628,7 +628,7 @@ function ArrayUnshift(arg1) {  // length == 1
   var num_arguments = %_ArgumentsLength();
   var is_sealed = ObjectIsSealed(array);
 
-  if (IS_ARRAY(array) && !is_sealed) {
+  if (IS_ARRAY(array) && !is_sealed && len > 0) {
     SmartMove(array, 0, 0, len, num_arguments);
   } else {
     SimpleMove(array, 0, 0, len, num_arguments);