Let's use Ryosuke's JSArray::fastSlice() for Array.prototype.splice() too :-)
*** This bug has been marked as a duplicate of bug 145303 ***