Avoid |Array.prototype.splice| call with one parameter

The one-parameter |Array.prototype.splice| call is a SpiderMonkey
extension. Apparently, IE doesn't implement it (unlike other supported
browsers), so we need to replace it with two-parameter version.

lib/compiler/passes/generate-javascript.js

@@ -203,7 +203,7 @@ module.exports = function(ast, options) {
       '          break;',
       '',
       '        case ' + op.WRAP + ':',             // WRAP n
-      '          stack.push(stack.splice(stack.length - bc[ip + 1]));',
+      '          stack.push(stack.splice(stack.length - bc[ip + 1], bc[ip + 1]));',
       '          ip += 2;',
       '          break;',
       '',