[Not for commit] Make Array.splice change receiver's FixedArray when significant part is cut.

test/mjsunit/array-splice.js

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 200 matching lines @@
     array = [1, 2, 3];
     spliced = array.splice({valueOf: function() { return 1; }},
                            {toString: function() { return 2; }},
                            'one', 'two');
     assertEquals([2, 3], spliced);
     assertEquals([1, 'one', 'two'], array);
   }
 })();
 
 
+// Check behavior on significant part spliced.
+(function() {
+  var array, spliced;
+  for (var i = 0; i < 7; i++) {
+    array = [1, 2, 3, 4, 5, 6, 7];
+    spliced = array.splice(-100, 100, 9);
+    assertEquals([9], array);
+    assertEquals([1, 2, 3, 4, 5, 6, 7], spliced);
+  }
+
+  for (var i = 0; i < 7; i++) {
+    array = [1, 2, 3, 4, 5, 6, 7];
+    spliced = array.splice(0, 6, 9);
+    assertEquals([9, 7], array);
+    assertEquals([1, 2, 3, 4, 5, 6], spliced);
+  }
+
+  for (var i = 0; i < 7; i++) {
+    array = [1, 2, 3, 4, 5, 6, 7];
+    spliced = array.splice(1, 5, 9);
+    assertEquals([1, 9, 7], array);
+    assertEquals([2, 3, 4, 5, 6], spliced);
+  }
+
+  for (var i = 0; i < 7; i++) {
+    array = [1, 2, 3, 4, 5, 6, 7];
+    spliced = array.splice(1, 100, 9);
+    assertEquals([1, 9], array);
+    assertEquals([2, 3, 4, 5, 6, 7], spliced);
+  }
+
+})();
+
+
 // Nasty: modify the array in ToInteger.
 (function() {
   var array = [];
   var spliced;
 
   for (var i = 0; i < 13; i++) {
     bad_start = { valueOf: function() { array.push(2*i); return -1; } };
     bad_count = { valueOf: function() { array.push(2*i + 1); return 1; } };
     spliced = array.splice(bad_start, bad_count);
     // According to the spec (15.4.4.12), length is calculated before
@@ skipping 80 matching lines @@
 
 (function() {
   for (var i = 0; i < 7; i++) {
     var a = [7, 8, 9];
     a.splice(0, 0, 1, 2, 3, 4, 5, 6);
     assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9], a);
     assertFalse(a.hasOwnProperty(10), "a.hasOwnProperty(10)");
     assertEquals(undefined, a[10]);
   }
 })();