avm1: Fix panic with [].unshift(x)

core/src/avm1/globals/array.rs

@@ -147,8 +147,10 @@ pub fn unshift<'gc>(
     let new_length = old_length + args.len();
     let offset = new_length - old_length;
 
-    for i in (old_length - 1..new_length).rev() {
-        this.set_array_element(i, this.array_element(i - offset), context.gc_context);
+    if old_length > 0 {
+        for i in (old_length - 1..new_length).rev() {
+            this.set_array_element(i, this.array_element(i - offset), context.gc_context);
+        }
     }
 
     for i in 0..args.len() {

core/tests/swfs/avm1/array_trivial/output.txt

@@ -185,3 +185,9 @@ undefined
 // array[2]
 undefined
 
+// array.unshift(1,2)
+2
+
+// array
+1,2
+