Cap splice's index parameter to length

When the index parameter of a splice is beyond its length then the
length should be taken as the index.

http://www.ecma-international.org/ecma-262/5.1/#sec-15.4.4.12
```
6. If relativeStart is negative, let actualStart be max((len + relativeStart),0); else let actualStart be min(relativeStart, len).
```