ArraySplice builtin should return empty array and not alter receiver if invoked with no arguments.

test/mjsunit/array-splice.js

Index: test/mjsunit/array-splice.js
diff --git a/test/mjsunit/array-splice.js b/test/mjsunit/array-splice.js
index 68dd9b2baff02029217610be99ac62e9c4f2463c..0e307b5d3d8a28b4055a76ec49b9d1f4ac71ecae 100644
--- a/test/mjsunit/array-splice.js
+++ b/test/mjsunit/array-splice.js
@@ -339,6 +339,20 @@
 })();
 
 
+// Check the case of JS builtin .splice()
+(function() {
+  for (var i = 0; i < 7; i++) {
+    var array = [1, 2, 3, 4];
+    Array.prototype[3] = 'foo';  // To force JS builtin.
+
+    var spliced = array.splice();
+
+    assertEquals([], spliced);
+    assertEquals([1, 2, 3, 4], array);
+  }
+})();
+
+
 // Check the behaviour when approaching maximal values for length.
 (function() {
   for (var i = 0; i < 7; i++) {