Use InternalArray during ObservedArraySplice to avoid page script interfering with self-hosted code

src/array.js

Index: src/array.js
diff --git a/src/array.js b/src/array.js
index ef7aae4774f92764c788be57f4de4d3f62171e9f..00cd694de92dd856f1f9b614842b317e41686bcd 100644
--- a/src/array.js
+++ b/src/array.js
@@ -724,8 +724,7 @@ function ObservedArraySplice(start, delete_count) {
   var start_i = ComputeSpliceStartIndex(TO_INTEGER(start), len);
   var del_count = ComputeSpliceDeleteCount(delete_count, num_arguments, len,
                                            start_i);
-  var deleted_elements = [];
-  deleted_elements.length = del_count;
+  var deleted_elements = new InternalArray(del_count);
   var num_elements_to_add = num_arguments > 2 ? num_arguments - 2 : 0;
 
   try {
@@ -747,10 +746,9 @@ function ObservedArraySplice(start, delete_count) {
   } finally {
     EndPerformSplice(this);
     if (deleted_elements.length || num_elements_to_add) {
-       EnqueueSpliceRecord(this,
-                           start_i,
-                           deleted_elements.slice(),
-                           num_elements_to_add);
+      var deleted_array = [];
+      %MoveArrayContents(deleted_elements, deleted_array);
+      EnqueueSpliceRecord(this, start_i, deleted_array, num_elements_to_add);
     }
   }