LibJS: Pass in actual_delete_count to removed array creation in splice

More specifically, Array.prototype.splice. Additionally adds a missing
exception check to the array creation and a link to the spec.

Fixes create-non-array-invalid-len.js in the splice tests in test262.
This test timed out instead of throwing an "Invalid array length"
exception.

Userland/Libraries/LibJS/Tests/builtins/Array/Array.prototype.splice.js

@@ -47,3 +47,18 @@ test("basic functionality", () => {
     expect(array).toEqual([]);
     expect(removed).toEqual(["foo", "bar", "baz"]);
 });
+
+// FIXME: These tests are currently skipped because an invalid array length in this case is 2**32 or above.
+//        The codebase currently uses size_t for lengths, which is currently the same as u32 when building for Serenity.
+//        This means these lengths wrap around to 0, making the test not work correctly.
+test.skip("Invalid lengths", () => {
+    var length = Math.pow(2, 32);
+
+    var obj = {
+        length: length,
+    };
+
+    expect(() => {
+        Array.prototype.splice.call(obj, 0);
+    }).toThrowWithMessage(RangeError, "Invalid array length");
+});