Fixes #12191

When Array.prototype.splice is called with only the start argument (e.g. .splice(0) to clear an array), the second argument (deleteCount) is omitted. In _onDataSplice, this caused arguments.length - 2 to evaluate to -1, which is truthy and led to _insertElements being called with a negative count, throwing:

RangeError: Invalid array length

The fix changes the condition from if (newCount) to if (newCount > 0) so that negative values from omitted arguments are properly ignored.

Added a test that verifies data.splice(0) works without throwing.