Bugfix in Array.splice()