jscript: Fix Array.prototype.splice with omitted deleteCount in ES5+ mode.

dlls/jscript/array.c

@@ -870,6 +870,8 @@ static HRESULT Array_splice(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsign
         }
 
         add_args = argc-2;
+    } else if (argc && ctx->version >= SCRIPTLANGUAGEVERSION_ES5) {
+        delete_cnt = length-start;
     }
 
     if(r) {

dlls/jscript/tests/api.js

@@ -1310,8 +1310,8 @@ ok(arr.toString() == "1,2,3,4,5", "arr.splice(2,-1) is " + arr.toString());
 
 arr = [1,2,3,4,5];
 tmp = arr.splice(2);
-ok(tmp.toString() == "", "arr.splice(2,-1) returned " + tmp.toString());
-ok(arr.toString() == "1,2,3,4,5", "arr.splice(2,-1) is " + arr.toString());
+ok(tmp.toString() == "", "arr.splice(2) returned " + tmp.toString());
+ok(arr.toString() == "1,2,3,4,5", "arr.splice(2) is " + arr.toString());
 
 arr = [1,2,3,4,5];
 tmp = arr.splice();

dlls/mshtml/tests/es5.js

@@ -374,6 +374,13 @@ sync_test("isArray", function() {
     expect_array(new C(), false);
 });
 
+sync_test("array_splice", function() {
+    var arr = [1,2,3,4,5]
+    var tmp = arr.splice(2);
+    ok(arr.toString() === "1,2", "arr = " + arr);
+    ok(tmp.toString() === "3,4,5", "tmp = " + tmp);
+});
+
 sync_test("array_map", function() {
     var calls, m, arr, ctx;