Array.prototype.splice is wrong w.r.t ES6 spec

[Saam Barati]

Specifically, this code is wrong:
```
            for (unsigned k = 0; k < deleteCount; ++k) {
                JSValue v = getProperty(exec, thisObj, k + begin);
                if (UNLIKELY(vm.exception()))
                    return JSValue::encode(jsUndefined());
                if (!v)
                    continue;
                result->putByIndexInline(exec, k, v, true);
                if (UNLIKELY(vm.exception()))
                    return JSValue::encode(jsUndefined());
            }
```
We should be calling defineOwnProperty.
See spec:
https://tc39.github.io/ecma262/#sec-array.prototype.splice
and
https://tc39.github.io/ecma262/#sec-createdatapropertyorthrow

[Saam Barati]

*** This bug has been marked as a duplicate of bug 171591 ***