[typedarray] Replace quicksort with mergesort to make TA#sort stable

This CL replaces the current TypedArray#sort with a simpler mergesort.
The fastpath when the user does not provide a comparison function
is still used.

In addition, TypedArray#sort now converts all elements in the
TypedArray to tagged values upfront, sorts them and writes them
back into the TypedArray as the final step.

R=jgruber@chromium.org, tebbi@chromium.org

Bug: v8:8567
Change-Id: Ib672c5cf510f7c0a2e722d1baa2704305a9ff235
Reviewed-on: https://chromium-review.googlesource.com/c/1445987
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59271}

test/mjsunit/es6/typedarray-sort.js

@@ -69,6 +69,18 @@ for (var constructor of typedArrayConstructors) {
   assertThrows(() => array.sort(), TypeError);
 }
 
+// Check that TypedArray.p.sort is stable.
+for (let constructor of typedArrayConstructors) {
+  const template = [2, 1, 0, 4, 4, 4, 4, 4, 4, 4, 4];
+
+  const array = new constructor(template);
+  // Treat 0..3, 4..7, etc. as equal.
+  const compare = (a, b) => (a / 4 | 0) - (b / 4 | 0);
+  array.sort(compare);
+
+  assertArrayLikeEquals(array.slice(0, 3), [2, 1, 0], constructor);
+}
+
 // The following creates a test for each typed element kind, where the array
 // to sort consists of some max/min/zero elements.
 //