Array.observe emit splices for array length change and update index >= length

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index d466f6571515d3eeb8aaf5b082f7591c36cfd89c..edab626c3d37fdf184d005cea2148b4ee95b8721 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -2396,6 +2396,17 @@ class JSObject: public JSReceiver {
                                   Handle<Name> name,
                                   Handle<Object> old_value);
 
+  // Enqueue "splice" change record for Object.observe. May cause GC.
+  static void EnqueueSpliceRecord(Handle<JSObject> object,
+                                  uint32_t index,
+                                  Handle<JSArray> deleted,
+                                  uint32_t delete_count,
+                                  uint32_t add_count);
+
+  // Object.getNotifier(this).performChange('splice'). May cause GC.
+  static void BeginPerformSplice(Handle<JSObject> object);
+  static void EndPerformSplice(Handle<JSObject> object);
+
   // Deliver change records to observers. May cause GC.
   static void DeliverChangeRecords(Isolate* isolate);