[PATCH v2 1/1] jscript: fix Array.prototype.splice with omitted deleteCount in html mode

[Yuxuan Shui]

From: Yuxuan Shui

---
 dlls/jscript/array.c      | 2 ++
 dlls/jscript/tests/api.js | 4 ++--
 dlls/mshtml/tests/es5.js  | 7 +++++++
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/dlls/jscript/array.c b/dlls/jscript/array.c
index 4e1af864a8e..d4ec197b13a 100644
--- a/dlls/jscript/array.c
+++ b/dlls/jscript/array.c
@@ -870,6 +870,8 @@ static HRESULT Array_splice(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsign
         }

add_args = argc-2;
+    } else if (argc && ctx->html_mode) {
+        delete_cnt = length-start;
     }

if(r) {
diff --git a/dlls/jscript/tests/api.js b/dlls/jscript/tests/api.js
index 0fc683c20cb..aea412347b9 100644
--- a/dlls/jscript/tests/api.js
+++ b/dlls/jscript/tests/api.js
@@ -1310,8 +1310,8 @@ ok(arr.toString() == "1,2,3,4,5", "arr.splice(2,-1) is " + arr.toString());

arr = [1,2,3,4,5];
 tmp = arr.splice(2);
-ok(tmp.toString() == "", "arr.splice(2,-1) returned " + tmp.toString());
-ok(arr.toString() == "1,2,3,4,5", "arr.splice(2,-1) is " + arr.toString());
+ok(tmp.toString() == "", "arr.splice(2) returned " + tmp.toString());
+ok(arr.toString() == "1,2,3,4,5", "arr.splice(2) is " + arr.toString());

arr = [1,2,3,4,5];
 tmp = arr.splice();
diff --git a/dlls/mshtml/tests/es5.js b/dlls/mshtml/tests/es5.js
index 38a70740698..65cf85965a0 100644
--- a/dlls/mshtml/tests/es5.js
+++ b/dlls/mshtml/tests/es5.js
@@ -374,6 +374,13 @@ sync_test("isArray", function() {
     expect_array(new C(), false);
 });

+sync_test("array_splice", function() {
+    var arr = [1,2,3,4,5]
+    tmp = arr.splice(2);
+    ok(arr.toString() === "1,2", "arr = " + arr);
+    ok(tmp.toString() === "3,4,5", "tmp = " + tmp);
+});
+
 sync_test("array_map", function() {
     var calls, m, arr, ctx;