Array.prototype.{slice,splice} should use [[DefineOwnProperty]] to generate return value

src/array.js

Index: src/array.js
diff --git a/src/array.js b/src/array.js
index b6f3a89d698fee679b4ae1a6e9c5c2eb9d8da969..d9db77b2a48914fefe4585695404c1b8758f0d73 100644
--- a/src/array.js
+++ b/src/array.js
@@ -286,7 +286,9 @@ function SimpleSlice(array, start_i, del_count, len, deleted_elements) {
     // prototype.
     var current = array[index];
     if (!IS_UNDEFINED(current) || index in array) {

[Michael Starzinger, 2014/10/21 08:07:48]

I know this is not part of your change, but the ordering of the [[Get]] and
[[Has]] calls in this predicate is also off. It first loads the property and
then (if the value is undefined) checks presence of the property. The following
is a repro:

var a = [1, 2, 3];
Object.defineProperty(a, '1', {
  get: function() { delete this[1]; return undefined; },
  configurable: true
});
var s = a.slice(1);
assertTrue('0' in s);

-      deleted_elements[i] = current;
+      // The spec requires [[DefineOwnProperty]] here, %AddElement is close
+      // enough (in that it ignores the prototype).
+      %AddElement(deleted_elements, i, current, NONE);
     }
   }
 }