Fix invalid fast return in splice when returned array is empty.

test/mjsunit/array-splice.js

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 35 matching lines @@
 (function() {
   for (var i = 0; i < 7; i++) {
     assertEquals([], [].splice(0, 0));
     assertEquals([], [].splice(1, 0));
     assertEquals([], [].splice(0, 1));
     assertEquals([], [].splice(-1, 0));
   }
 })();
 
 
+// Check that even if result array is empty, receiver gets sliced.
+(function() {
+  for (var i = 0; i < 7; i++) {
+    var a = [1, 2, 3];
+    assertEquals([], a.splice(1, 0, 'a', 'b', 'c'));
+    assertEquals([1, 'a', 'b', 'c', 2, 3], a);
+  }
+})();
+
+
 // Check various forms of arguments omission.
 (function() {
   var array;
   for (var i = 0; i < 7; i++) {
     // SpiderMonkey and JSC return undefined in the case where no
     // arguments are given instead of using the implicit undefined
     // arguments.  This does not follow ECMA-262, but we do the same for
     // compatibility.
     // TraceMonkey follows ECMA-262 though.
     array = [1, 2, 3]
@@ skipping 235 matching lines @@
 
 (function() {
   for (var i = 0; i < 7; i++) {
     var a = [7, 8, 9];
     a.splice(0, 0, 1, 2, 3, 4, 5, 6);
     assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9], a);
     assertFalse(a.hasOwnProperty(10));
     assertEquals(undefined, a[10]);
   }
 })();