[change-array-by-copy] Support large arrays in toSpliced

Also drive-by adds a test for toSpliced on an empty array.

Bug: chromium:1367651, v8:12764
Change-Id: I59ff19ef73dd6c5ea972dc6f39f1968858099ef8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3919870
Commit-Queue: Adam Klein <adamk@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83441}

src/builtins/array-to-spliced.tq

@@ -14,8 +14,8 @@ macro CopyFastPackedArrayForToSpliced(implicit context: Context)(
   const insertCount: intptr = Convert<intptr>(insertCountSmi);
   const actualDeleteCount: intptr = Convert<intptr>(actualDeleteCountSmi);
 
-  const copy: FixedArrayBase =
-      AllocateFixedArray(kind, newLen, AllocationFlag::kNone);
+  const copy: FixedArrayBase = AllocateFixedArray(
+      kind, newLen, AllocationFlag::kAllowLargeObjectAllocation);
 
   // Copy the part before the inserted items.
   CopyElements(kind, copy, 0, array.elements, 0, actualStart);

test/mjsunit/harmony/array-to-spliced-big.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-change-array-by-copy
+
+(function TestBigPacked() {
+  let a = [];
+  for (let i = 0; i < 50000; i++) a.push(i);
+  let r = a.toSpliced();
+})();

test/mjsunit/harmony/array-to-spliced.js

@@ -101,6 +101,10 @@ TestToSplicedBasicBehaviorHelper({ length: 4,
   assertEquals(Array, (new MyArray()).toSpliced().constructor);
 })();
 
+(function TestEmpty() {
+  assertEquals([], [].toSpliced());
+})();
+
 // All tests after this have an invalidated elements-on-prototype protector.
 (function TestNoHoles() {
   const a = [,,,,];

test/mjsunit/mjsunit.status

@@ -1414,9 +1414,11 @@
   # takes several minutes overall.
   'regress/wasm/regress-9017': [SKIP],
 
-  # This tests Array#toReversed on a big packed array, which is created by
-  # repeated calls to Array#push. In the slow path this is very slow.
+  # These test Array#toReversed and Array#toSpliced on a big packed array, which
+  # is created by repeated calls to Array#push. In the slow path this is very
+  # slow.
   'harmony/array-to-reversed-big': [SKIP],
+  'harmony/array-to-spliced-big': [SKIP],
 }],  # variant == slow_path
 
 ['((arch == mips64el or arch == mips64) and not simd_mips) or (arch in [ppc64])', {