Bug 1006065 - Remove bogus assert in ArraySpliceDense and add a testcase. r=h4writer