diff --git a/src/array.js b/src/array.js index 2fa48b077a..ea4f3b41cb 100644 --- a/src/array.js +++ b/src/array.js @@ -651,17 +651,6 @@ function ArrayUnshift(arg1) { // length == 1 if (IS_ARRAY(this) && !is_sealed) { SmartMove(this, 0, 0, len, num_arguments); } else { - if (num_arguments == 0 && ObjectIsFrozen(this)) { - // In the zero argument case, values from the prototype come into the - // object. This can't be allowed on frozen arrays. - for (var i = 0; i < len; i++) { - if (!this.hasOwnProperty(i) && !IS_UNDEFINED(this[i])) { - throw MakeTypeError("array_functions_on_frozen", - ["Array.prototype.shift"]); - } - } - } - SimpleMove(this, 0, 0, len, num_arguments); } diff --git a/test/mjsunit/regress/regress-builtinbust-5.js b/test/mjsunit/regress/regress-builtinbust-5.js new file mode 100644 index 0000000000..266e4d48bd --- /dev/null +++ b/test/mjsunit/regress/regress-builtinbust-5.js @@ -0,0 +1,13 @@ +// Copyright 2014 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +var a = [ 1, 2, 3 ]; +var was_called = false; +function poison() { was_called = true; } +a.hasOwnProperty = poison; +Object.freeze(a); + +assertThrows("a.unshift()", TypeError); +assertEquals(3, a.length); +assertFalse(was_called);