X64: Ensure that unary subtraction returns a zero-extended smi, if it returns a smi.

Review URL: http://codereview.chromium.org/195101

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2900 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/x64/codegen-x64.cc

@@ -6320,7 +6320,7 @@ void UnarySubStub::Generate(MacroAssembler* masm) {
   // Also enter it if the value of the smi is Smi::kMinValue
   __ testl(rax, Immediate(0x7FFFFFFE));
   __ j(zero, &special);
-  __ neg(rax);
+  __ negl(rax);
   __ jmp(&done);
 
   __ bind(&special);

test/mjsunit/array-splice.js

@@ -309,3 +309,6 @@ Array.prototype[1] = 1;
 assertEquals(1, arr.pop());
 assertEquals(0, arr.pop());
 Array.prototype[1] = undefined;
+
+// Test http://code.google.com/p/chromium/issues/detail?id=21860
+Array.prototype.push.apply([], [1].splice(0, -(-1 % 5)));