[turbofan] Remove stability check in Array builtin inlining

This removes a stability check from CanInlineArrayResizeOperation. This
is safe, since all prototype maps are either stable or in dictionary
mode, where the latter is ruled out separately.

Bug: v8:7127, v8:7205
Change-Id: I3a07805cb89f41adf031c6c2a6dd5b2defcb87a8
Reviewed-on: https://chromium-review.googlesource.com/848778
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50353}

src/compiler/js-call-reducer.cc

@@ -3360,7 +3360,6 @@ bool CanInlineArrayResizeOperation(Handle<Map> receiver_map) {
   return receiver_map->instance_type() == JS_ARRAY_TYPE &&
          IsFastElementsKind(receiver_map->elements_kind()) &&
          !receiver_map->is_dictionary_map() && receiver_map->is_extensible() &&
-         (!receiver_map->is_prototype_map() || receiver_map->is_stable()) &&
          isolate->IsAnyInitialArrayPrototype(receiver_prototype) &&
          !IsReadOnlyLengthDescriptor(receiver_map);
 }