Bug 614070 - Fix Array.prototype.unshift to always set the new length on this. r=jwalden

js/src/jsarray.cpp

@@ -2222,9 +2222,9 @@ array_unshift(JSContext *cx, uintN argc, Value *vp)
             return JS_FALSE;
 
         newlen += argc;
+    }
     if (!js_SetLengthProperty(cx, obj, newlen))
         return JS_FALSE;
-    }
 
     /* Follow Perl by returning the new array length. */
     vp->setNumber(newlen);

js/src/tests/ecma_5/Array/jstests.list

@@ -2,3 +2,4 @@ url-prefix ../../jsreftest.html?test=ecma_5/Array/
 script sort-01.js
 script toString-01.js
 script toLocaleString-01.js
+script unshift-01.js

js/src/tests/ecma_5/Array/unshift-01.js

@@ -0,0 +1,41 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 614070;
+var summary = 'Array.prototype.unshift without args';
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+var a = {};
+a.length = 4294967296;
+assertEq([].unshift.call(a), 0);
+assertEq(a.length, 0);
+
+function testGetSet(len, expected) {
+    var newlen;
+    var a = { get length() { return len; }, set length(v) { newlen = v; } };
+    var res = [].unshift.call(a);
+    assertEq(res, expected);
+    assertEq(newlen, expected);
+}
+
+testGetSet(0, 0);
+testGetSet(10, 10);
+testGetSet("1", 1);
+testGetSet(null, 0);
+testGetSet(4294967297, 1);
+testGetSet(-5, 4294967291);
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("All tests passed!");