Fix Array.{splice,slice} to set proper ElementsKind of result

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index e758b9a41587141e380ec2ddf446a78c8f989e80..f252911d9fc5418d736674f20b2ba660bd25aa3b 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -772,6 +772,13 @@ BUILTIN(ArraySlice) {
 
   // Set the length.
   result_array->set_length(Smi::FromInt(result_len));
+
+  // Set the ElementsKind.
+  ElementsKind elements_kind = JSObject::cast(receiver)->GetElementsKind();
+  if (result_array->GetElementsKind() != elements_kind) {
+    MaybeObject* maybe = result_array->TransitionElementsKind(elements_kind);
+    if (maybe->IsFailure()) return maybe;
+  }
   return result_array;
 }
 
@@ -865,6 +872,13 @@ BUILTIN(ArraySplice) {
 
     // Set the length.
     result_array->set_length(Smi::FromInt(actual_delete_count));
+
+    // Set the ElementsKind.
+    ElementsKind elements_kind = array->GetElementsKind();
+    if (result_array->GetElementsKind() != elements_kind) {
+      MaybeObject* maybe = result_array->TransitionElementsKind(elements_kind);
+      if (maybe->IsFailure()) return maybe;
+    }
   }
 
   int item_count = (n_arguments > 1) ? (n_arguments - 2) : 0;