ArraySplice builtin should return empty array and not alter receiver if invoked with no arguments.

test/mjsunit/array-splice.js

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 321 matching lines @@
     assertFalse(array.hasOwnProperty(10), "array.hasOwnProperty(10)");
     assertFalse(array.hasOwnProperty(15), "array.hasOwnProperty(15)");
     assertFalse(array.hasOwnProperty(31), "array.hasOwnProperty(31)");
     assertFalse(array.hasOwnProperty(63), "array.hasOwnProperty(63)");
     assertFalse(array.hasOwnProperty(2 << 32 - 1),
                 "array.hasOwnProperty(2 << 31 - 1)");
   }
 })();
 
 
+// Check the case of JS builtin .splice()
+(function() {
+  for (var i = 0; i < 7; i++) {
+    var array = [1, 2, 3, 4];
+    Array.prototype[3] = 'foo';  // To force JS builtin.
+
+    var spliced = array.splice();
+
+    assertEquals([], spliced);
+    assertEquals([1, 2, 3, 4], array);
+  }
+})();
+
+
 // Check the behaviour when approaching maximal values for length.
 (function() {
   for (var i = 0; i < 7; i++) {
     try {
       new Array((1 << 32) - 3).splice(-1, 0, 1, 2, 3, 4, 5);
       throw 'Should have thrown RangeError';
     } catch (e) {
       assertTrue(e instanceof RangeError);
     }
 
     // Check smi boundary
     var bigNum = (1 << 30) - 3;
     var array = new Array(bigNum);
     array.splice(-1, 0, 1, 2, 3, 4, 5, 6, 7);
     assertEquals(bigNum + 7, array.length);
   }
 })();
 
 (function() {
   for (var i = 0; i < 7; i++) {
     var a = [7, 8, 9];
     a.splice(0, 0, 1, 2, 3, 4, 5, 6);
     assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9], a);
     assertFalse(a.hasOwnProperty(10), "a.hasOwnProperty(10)");
     assertEquals(undefined, a[10]);
   }
 })();