Array.observe emit splices for array length change and update index >= length

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 34d05330f32943dbf9dbb6dda93dd30cd7c93e59..a903f7482886803163c818e5be488a42fa0598ff 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -2399,6 +2399,17 @@ class JSObject: public JSReceiver {
                                   Handle<Name> name,
                                   Handle<Object> old_value);
 
+  // Enqueue "splice" change record for Object.observe. May cause GC.
+  static void EnqueueSpliceRecord(Handle<JSArray> object,

[adamk, 2013/05/24 00:15:30]

Is there any need to expose these as part of the JSObject interface? If they're
only used in objects.cc, they could just be free file-scoped functions instead.
I mention it because now that they take JSArrays, they seem a bit odd in
JSObject.

[rafaelw, 2013/05/24 19:11:43]

Done.

+                                  uint32_t index,
+                                  Handle<JSArray> deleted,
+                                  uint32_t delete_count,
+                                  uint32_t add_count);
+
+  // Object.getNotifier(this).performChange('splice'). May cause GC.
+  static void BeginPerformSplice(Handle<JSArray> object);
+  static void EndPerformSplice(Handle<JSArray> object);
+
   // Deliver change records to observers. May cause GC.
   static void DeliverChangeRecords(Isolate* isolate);