Array.prototype.splice doesn't set "length" of returned object
Created attachment 400085 [details] Patch
Committed r262088: <https://trac.webkit.org/changeset/262088> All reviewed patches have been landed. Closing bug and clearing flags on attachment 400085 [details].
<rdar://problem/63558637>