All calls to [[Delete]] from Array.prototype are specified to pass 'true' as the value of Throw. In the case of shift/unshift, these are also missing a throw from the 'put' in the implementations in JSArray.cpp. There are effectively three copies of each of the generic shift/unshift routines, one in splice, one in ArrayPrototype's shift/unshift methods, and one in JSArray's shift/unshift routines, for handling arrays with holes. These three copies should be unified.
Created attachment 130505 [details]
Attachment 130505 [details] did not pass style-queue:
Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/fast..." exit_code: 1
LayoutTests/ChangeLog:1: ChangeLog entry has no bug number [changelog/bugnumber] 
Total errors found: 1 in 11 files
If any of these errors are false positives, please file a bug against check-webkit-style.
Created attachment 130509 [details]
Fix (forgot a ChangeLog in last patch)
Fixed in r110026