Fix Array.{splice,slice} to set proper ElementsKind of result

test/mjsunit/elements-kind.js

Index: test/mjsunit/elements-kind.js
diff --git a/test/mjsunit/elements-kind.js b/test/mjsunit/elements-kind.js
index cfd47c7781203078ecf7a3892cfa9abbe8ff62fa..a86202e0fbc85f0dc2cba946c8cd87e342b65fdb 100644
--- a/test/mjsunit/elements-kind.js
+++ b/test/mjsunit/elements-kind.js
@@ -305,5 +305,15 @@ if (support_smi_only_arrays) {
   assertTrue(%HaveSameMap(e, f));
 }
 
+// Test that Array.splice() and Array.slice() return correct ElementsKinds.
+if (support_smi_only_arrays) {
+  var a = ["foo", "bar"];
+  assertKind(elements_kind.fast, a);
+  var b = a.splice(0, 1);
+  assertKind(elements_kind.fast, b);
+  var c = a.slice(0, 1);
+  assertKind(elements_kind.fast, c);
+}
+
 // Throw away type information in the ICs for next stress run.
 gc();