This will make it easier to see whether the code matches the spec or not. Ref: https://tc39.github.io/ecma262/#sec-array.prototype.splice
Created attachment 291389 [details] proposed patch.
Created attachment 291391 [details] proposed patch.
Comment on attachment 291391 [details] proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=291391&action=review > Source/JavaScriptCore/runtime/ArrayPrototype.cpp:972 > + unsigned itemCount = std::max<unsigned>(exec->argumentCount() - 2, 0); this doesn't seem correct.
Created attachment 291392 [details] proposed patch. Thanks for catching the bad cast. It's fixed.
Thanks for the review. Landed in r207241: <http://trac.webkit.org/r207241>.