valija apply() sometimes fails on non-firefox browsers

http://code.google.com/p/google-caja/issues/detail?id=1077

in valija, calling fn.apply({}) eventually calls
Array.slice(undefined, 0).  in firefox, Array.slice
is a builtin and returns [].  on other browsers,
Array.slice is defined in cajita.js, which tries to
evaluate undefined.length, which throws an exception.

this change makes cajita's Array.slice behave more
like firefox's.

[metaweta, 2009-07-20 14:13:10]

LGTM

[metaweta, 2009-07-20 14:26:04]

Sorry, just thought of a weird case to consider:

Number.prototype.length = 2;
Number.prototype[0] = 6;
Number.prototype[1] = 7;
Array.prototype.slice.apply(2, 0, (2).length);
// returns [6, 7]

Should we cast self = Object(self)?

[felix8a, 2009-07-20 16:13:40]

On 2009/07/20 14:26:04, metaweta wrote:
> Sorry, just thought of a weird case to consider:
> 
> Number.prototype.length = 2;
> Number.prototype[0] = 6;
> Number.prototype[1] = 7;
> Array.prototype.slice.apply(2, 0, (2).length);
> // returns [6, 7]
> 
> Should we cast self = Object(self)?

ah, yeah.  how about this?

[felix8a, 2009-07-20 16:16:06]

hangon, that's still not right.  need to delete the if..

[metaweta, 2009-07-20 16:20:54]

Mark posted this to the list:
"We don't need to worry about such code. It is illegal in Cajita of
course. And the Cajita runtime may assume the absence of such
uncajoled nonsense. However, we do need to document such assumptions."

So I guess we shouldn't waste the cycles on casting to Object, but rather should
document the assumption.

[felix8a, 2009-07-20 16:21:02]

On 2009/07/20 16:16:06, felix8a wrote:
> hangon, that's still not right.  need to delete the if..

oh, no, it is right.  IE's Array.prototype.slice is special.  ok, how's this?

[felix8a, 2009-07-20 16:28:15]

On 2009/07/20 16:20:54, metaweta wrote:
> Mark posted this to the list:
> "We don't need to worry about such code. It is illegal in Cajita of
> course. And the Cajita runtime may assume the absence of such
> uncajoled nonsense. However, we do need to document such assumptions."
> 
> So I guess we shouldn't waste the cycles on casting to Object, but rather
should
> document the assumption.

ok, reverting to early patch, with a new coment

[metaweta, 2009-07-20 17:00:57]

LGTM

[felix8a, 2009-07-21 22:19:51]

@r3601