Bug 595963: notify iterators about property deletion in array_splice, r=gal

js/src/jsarray.cpp

@@ -2338,6 +2338,7 @@ array_splice(JSContext *cx, uintN argc, Value *vp)
     JSObject *obj = ComputeThisFromVp(cx, vp);
     if (!obj || !js_GetLengthProperty(cx, obj, &length))
         return JS_FALSE;
+    jsuint origlength = length;
 
     /* Convert the first argument into a starting index. */
     jsdouble d;
@@ -2452,6 +2453,9 @@ array_splice(JSContext *cx, uintN argc, Value *vp)
         length -= delta;
     }
 
+    if (length < origlength && !js_SuppressDeletedIndexProperties(cx, obj, length, origlength))
+        return JS_FALSE;
+
     /*
      * Copy from argv into the hole to complete the splice, and update length in
      * case we deleted elements from the end.