Merge V8 5.2.361.47  DO NOT MERGE

https://chromium.googlesource.com/v8/v8/+/5.2.361.47

FPIIM-449

Change-Id: Ibec421b85a9b88cb3a432ada642e469fe7e78346
(cherry picked from commit bcf72ee8e3b26f1d0726869c7ddb3921c68b09a8)
diff --git a/test/mjsunit/array-splice.js b/test/mjsunit/array-splice.js
index 744e954..75ff2d1 100644
--- a/test/mjsunit/array-splice.js
+++ b/test/mjsunit/array-splice.js
@@ -300,6 +300,55 @@
   }
 })();
 
+// Check the behaviour when approaching maximal values for length.
+(function() {
+  for (var i = 0; i < 7; i++) {
+    try {
+      new Array(Math.pow(2, 32) - 3).splice(-1, 0, 1, 2, 3, 4, 5);
+      throw 'Should have thrown RangeError';
+    } catch (e) {
+      assertTrue(e instanceof RangeError);
+    }
+
+    // Check smi boundary
+    var bigNum = (1 << 30) - 3;
+    var array = new Array(bigNum);
+    array.splice(-1, 0, 1, 2, 3, 4, 5, 6, 7);
+    assertEquals(bigNum + 7, array.length);
+  }
+})();
+
+(function() {
+  for (var i = 0; i < 7; i++) {
+    var a = [7, 8, 9];
+    a.splice(0, 0, 1, 2, 3, 4, 5, 6);
+    assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9], a);
+    assertFalse(a.hasOwnProperty(10), "a.hasOwnProperty(10)");
+    assertEquals(undefined, a[10]);
+  }
+})();
+
+(function testSpliceDeleteDouble() {
+  var a = [1.1, 1.2, 1.3, 1.4];
+  a.splice(2, 1)
+  assertEquals([1.1, 1.2, 1.4], a);
+})();
+
+// Past this point the ArrayProtector is invalidated since we modify the
+// Array.prototype.
+
+// Check the case of JS builtin .splice()
+(function() {
+  for (var i = 0; i < 7; i++) {
+    var array = [1, 2, 3, 4];
+    Array.prototype[3] = 'foo';  // To force JS builtin.
+
+    var spliced = array.splice();
+
+    assertEquals([], spliced);
+    assertEquals([1, 2, 3, 4], array);
+  }
+})();
 
 // Now check the case with array of holes and some elements on prototype.
 (function() {
@@ -350,7 +399,6 @@
   }
 })();
 
-
 // Now check the case with array of holes and some elements on prototype.
 (function() {
   var len = 9;
@@ -397,46 +445,3 @@
                 "array.hasOwnProperty(Math.pow(2, 32) - 2)");
   }
 })();
-
-
-// Check the case of JS builtin .splice()
-(function() {
-  for (var i = 0; i < 7; i++) {
-    var array = [1, 2, 3, 4];
-    Array.prototype[3] = 'foo';  // To force JS builtin.
-
-    var spliced = array.splice();
-
-    assertEquals([], spliced);
-    assertEquals([1, 2, 3, 4], array);
-  }
-})();
-
-
-// Check the behaviour when approaching maximal values for length.
-(function() {
-  for (var i = 0; i < 7; i++) {
-    try {
-      new Array(Math.pow(2, 32) - 3).splice(-1, 0, 1, 2, 3, 4, 5);
-      throw 'Should have thrown RangeError';
-    } catch (e) {
-      assertTrue(e instanceof RangeError);
-    }
-
-    // Check smi boundary
-    var bigNum = (1 << 30) - 3;
-    var array = new Array(bigNum);
-    array.splice(-1, 0, 1, 2, 3, 4, 5, 6, 7);
-    assertEquals(bigNum + 7, array.length);
-  }
-})();
-
-(function() {
-  for (var i = 0; i < 7; i++) {
-    var a = [7, 8, 9];
-    a.splice(0, 0, 1, 2, 3, 4, 5, 6);
-    assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9], a);
-    assertFalse(a.hasOwnProperty(10), "a.hasOwnProperty(10)");
-    assertEquals(undefined, a[10]);
-  }
-})();