Array splice should only normalize deleted_elements if it's an array

Also slightly expand regression test to end with a return instead of
an exception.

R=cbruni@chromium.org
BUG=chromium:618788

Review-Url: https://codereview.chromium.org/2090193002
Cr-Commit-Position: refs/heads/master@{#37223}

src/js/array.js

@@ -729,7 +729,7 @@ function ArraySplice(start, delete_count) {
   }
   if (UseSparseVariant(array, len, IS_ARRAY(array), changed_elements)) {
     %NormalizeElements(array);
-    %NormalizeElements(deleted_elements);
+    if (IS_ARRAY(deleted_elements)) %NormalizeElements(deleted_elements);
     SparseSlice(array, start_i, del_count, len, deleted_elements);
     SparseMove(array, start_i, del_count, len, num_elements_to_add);
   } else {

test/mjsunit/regress/regress-crbug-618788.js

@@ -2,7 +2,20 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var a = new Array();
-a.constructor = Int32Array;
-a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
-assertThrows(() => a.slice());
+// Slice and splice both try to set the length property of their return
+// value. Add a bogus setter to allow that.
+Object.defineProperty(Int32Array.prototype, 'length', { set(v) { } });
+
+(function testSlice() {
+  var a = new Array();
+  a.constructor = Int32Array;
+  a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
+  assertTrue(a.slice() instanceof Int32Array);
+})();
+
+(function testSplice() {
+  var a = new Array();
+  a.constructor = Int32Array;
+  a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
+  assertTrue(a.splice(1) instanceof Int32Array);
+})();