[array] Add counter for sorting non-packed JSArrays.

This CL adds a counter for sorting non-packed JSArrays where
Object.prototype was modified, or the prototype of the instance
differs from Array.prototype.

This is the V8 side of the change.
The Chromium-side CL: https://crrev.com/c/1051651

R=jgruber@chromium.org

Bug: v8:7382
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I3ce9789a5df4bb9af5d1bfc89681fcd112e28e83
Reviewed-on: https://chromium-review.googlesource.com/1051650
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53101}

include/v8.h

@@ -7234,6 +7234,7 @@ class V8_EXPORT Isolate {
     kErrorStackTraceLimit = 45,
     kWebAssemblyInstantiation = 46,
     kDeoptimizerDisableSpeculation = 47,
+    kArrayPrototypeSortJSArrayModifiedPrototype = 48,
 
     // If you add new values here, you'll also need to update Chromium's:
     // web_feature.mojom, UseCounterCallback.cpp, and enums.xml. V8 changes to

src/objects-inl.h

@@ -2724,6 +2724,9 @@ bool JSObject::HasFastElements() {
   return IsFastElementsKind(GetElementsKind());
 }
 
+bool JSObject::HasFastPackedElements() {
+  return IsFastPackedElementsKind(GetElementsKind());
+}
 
 bool JSObject::HasDictionaryElements() {
   return GetElementsKind() == DICTIONARY_ELEMENTS;

src/objects.h

@@ -2289,6 +2289,8 @@ class JSObject: public JSReceiver {
   inline bool HasSmiOrObjectElements();
   // Returns true if an object has any of the "fast" elements kinds.
   inline bool HasFastElements();
+  // Returns true if an object has any of the PACKED elements kinds.
+  inline bool HasFastPackedElements();
   // Returns true if an object has elements of PACKED_DOUBLE_ELEMENTS or
   // HOLEY_DOUBLE_ELEMENTS ElementsKind.
   inline bool HasDoubleElements();

src/runtime/runtime-array.cc

@@ -319,6 +319,20 @@ RUNTIME_FUNCTION(Runtime_RemoveArrayHoles) {
     }
   }
 
+  // Counter for sorting arrays that have non-packed elements and where either
+  // the ElementsProtector is invalid or the prototype does not match
+  // Array.prototype.
+  if (object->IsJSArray() &&
+      !Handle<JSArray>::cast(object)->HasFastPackedElements()) {
+    JSObject* initial_array_proto = JSObject::cast(
+        isolate->native_context()->get(Context::INITIAL_ARRAY_PROTOTYPE_INDEX));
+    if (!isolate->IsNoElementsProtectorIntact() ||
+        object->map()->prototype() != initial_array_proto) {
+      isolate->CountUsage(
+          v8::Isolate::kArrayPrototypeSortJSArrayModifiedPrototype);
+    }
+  }
+
   return PrepareElementsForSort(object, limit);
 }