Fix missing writebarrier in ArraySplice builtin.

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index ae3dab46c3f3038a4a8157691211f1b7ec8e16ce..377de057a3e054b35fb17b54875187ee58701910 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -838,8 +838,8 @@ BUILTIN(ArraySplice) {
       const int delta = actual_delete_count - item_count;
 
       if (actual_start > 0) {
-        Object** start = elms->data_start();
-        memmove(start + delta, start, actual_start * kPointerSize);
+        AssertNoAllocation no_gc;
+        MoveElements(heap, &no_gc, elms, delta, elms, 0, actual_start);
       }
 
       elms = LeftTrimFixedArray(heap, elms, delta);