Array splice should only normalize deleted_elements if it's an array

test/mjsunit/regress/regress-crbug-618788.js

Index: test/mjsunit/regress/regress-crbug-618788.js
diff --git a/test/mjsunit/regress/regress-crbug-618788.js b/test/mjsunit/regress/regress-crbug-618788.js
index 6e49ec2f503762b7fc5f969caf46edb510f970d8..a104d8d39ed09a5f5bcd1b9092a1828f811ea249 100644
--- a/test/mjsunit/regress/regress-crbug-618788.js
+++ b/test/mjsunit/regress/regress-crbug-618788.js
@@ -2,7 +2,20 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var a = new Array();
-a.constructor = Int32Array;
-a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
-assertThrows(() => a.slice());
+// Slice and splice both try to set the length property of their return
+// value. Add a bogus setter to allow that.
+Object.defineProperty(Int32Array.prototype, 'length', { set(v) { } });
+
+(function testSlice() {
+  var a = new Array();
+  a.constructor = Int32Array;
+  a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
+  assertTrue(a.slice() instanceof Int32Array);
+})();
+
+(function testSplice() {
+  var a = new Array();
+  a.constructor = Int32Array;
+  a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
+  assertTrue(a.splice(1) instanceof Int32Array);
+})();