Fix sparse versions of Array slice/splice to use [[DefineOwnProperty]] to generate return value

test/mjsunit/regress/regress-423633.js

Index: test/mjsunit/regress/regress-423633.js
diff --git a/test/mjsunit/regress/regress-423633.js b/test/mjsunit/regress/regress-423633.js
index cad20645ba942417f75f07bc124172bfeef8320e..12d248333fbacbb1e0acb00887523f880fc7d603 100644
--- a/test/mjsunit/regress/regress-423633.js
+++ b/test/mjsunit/regress/regress-423633.js
@@ -8,3 +8,11 @@ Object.defineProperty(Array.prototype, '0', {
 var a = [1, 2, 3];
 assertEquals(a, a.slice());
 assertEquals([3], a.splice(2, 1));
+
+a = [1, 2, 3];
+a[0xffff] = 4;
+// nulling the prototype lets us stay in the sparse case; otherwise the
+// getter on Array.prototype would force us into the non-sparse code.
+a.__proto__ = null;
+assertEquals(a, Array.prototype.slice.call(a));
+assertEquals([3], Array.prototype.splice.call(a, 2, 1));