Array.observe emit splices for array length change and update index >= length

src/objects.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2378 matching lines @@
    public:
     static inline int SizeOf(Map* map, HeapObject* object);
   };
 
   // Enqueue change record for Object.observe. May cause GC.
   static void EnqueueChangeRecord(Handle<JSObject> object,
                                   const char* type,
                                   Handle<Name> name,
                                   Handle<Object> old_value);
 
+  // Enqueue "splice" change record for Object.observe. May cause GC.
+  static void EnqueueSpliceRecord(Handle<JSObject> object,
+                                  uint32_t index,
+                                  Handle<JSArray> deleted,
+                                  uint32_t delete_count,
+                                  uint32_t add_count);
+
+  // Object.getNotifier(this).performChange('splice'). May cause GC.
+  static void BeginPerformSplice(Handle<JSObject> object);
+  static void EndPerformSplice(Handle<JSObject> object);
+
   // Deliver change records to observers. May cause GC.
   static void DeliverChangeRecords(Isolate* isolate);
 
  private:
   friend class DictionaryElementsAccessor;
 
   MUST_USE_RESULT MaybeObject* GetElementWithCallback(Object* receiver,
                                                       Object* structure,
                                                       uint32_t index,
                                                       Object* holder);
@@ skipping 7199 matching lines @@
     } else {
       value &= ~(1 << bit_position);
     }
     return value;
   }
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_H_