The problem you have is that you push references to the date1 object. When you change the date on it in your loop, you update the object, but all references still point to the same object.

You need to either push a text representation of your date, or a copy of your date1 object

for (var i=0; date1 <= date2; date1.setDate(date1.getDate() + 1), i++) {
    alldates.push(new Date(date1));
    }

alert(alldates.join('\n'));

As suggested, with a while loop

while( date1 <= date2 ) {
  alldates.push(new Date(date1));
  date1.setDate( date1.getDate() +1 );
} 

Date.prototype.addDays = function(days) {
    var date = new Date(this.valueOf());
    date.setDate(date.getDate() + days);
    return date;
}

function getDates(startDate, stopDate) {
    var dateArray = new Array();
    var currentDate = startDate;
    while (currentDate <= stopDate) {
        dateArray.push(new Date (currentDate));
        currentDate = currentDate.addDays(1);
    }
    return dateArray;
}

Here is a functional demo http://jsfiddle.net/jfhartsock/cM3ZU/

The ES5 spec details the new Date(value) form of the Date constructor. In the algorithm for handling this form, value is converted to a primitive value by calling the [[DefaultValue]] internal method of the object.

Converting an array to a primitive value is basically done by converting the array to a string. Converting an array to a string (Array.prototype.toString) is effectively the same as calling dateArray.join().

Therefore, your call to the Date constructor will effectively look like this:

var dateObject = new Date("2012,6,5");

If the string can be recognised by the Date.parse method, you will end up with a Date instance.

This form of the Date constructor is also listed on MDN as new Date(dateString).

Firefox seems to fail when you pass an array, but it succeeds if you pass the string representation of that array. I would say that that's probably a Firefox bug, but I may be misinterpreting the ES5 spec.