convert copyonaccess arrays for Array.push

Author: MikeHolman

lib/Runtime/Library/JavascriptArray.cpp

@@ -5365,6 +5365,11 @@ using namespace Js;
     Var JavascriptArray::EntryPushJavascriptArray(ScriptContext * scriptContext, Var * args, uint argCount)
     {
         JavascriptArray * arr = JavascriptArray::FromAnyArray(args[0]);
+
+#if ENABLE_COPYONACCESS_ARRAY
+        JavascriptLibrary::CheckAndConvertCopyOnAccessNativeIntArray<Var>(arr);
+#endif
+
         uint n = arr->length;
         ThrowTypeErrorOnFailureHelper h(scriptContext, _u("Array.prototype.push"));
 

test/Array/CopyOnAccessArray_bugs.js

@@ -26,6 +26,8 @@ var tests = [
             var a=[1,2];
             Array.prototype.push.call(a,1);
             assert.areEqual([1,2,1], a, "Incorrect result from Array.prototype.push()");
+            
+            Array.prototype.push.call([0, 0, 0, 0, 0]);
         }
     },
     {