Fix bug in js_setlength when used for relative indices.
Fix bug in Array.prototype.splice().