Revert of Moving ArraySplice Builtin to ElementsAccessor (patchset #6...

Revert of Moving ArraySplice Builtin to ElementsAccessor (patchset #6 id:100001 of https://codereview.chromium.org/1293683005/ )

Reason for revert:
failing bot http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/3827

Original issue's description:
> - remove the Backing-Store speficic code from builtins.cc and put it in elements.cc.
> - adding tests to improve coverage of the splice method
>
> BUG=
>
> Committed: https://crrev.com/8533d4b5433d3a9e9fb1015f206997bd6d869fe3
> Cr-Commit-Position: refs/heads/master@{#30269}

TBR=mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1305763002

Cr-Commit-Position: refs/heads/master@{#30271}

src/elements.h

@@ -131,11 +131,6 @@ class ElementsAccessor {
                         Handle<FixedArrayBase> backing_store, Object** objects,
                         uint32_t start, int direction) = 0;
 
-  virtual Handle<JSArray> Splice(Handle<JSArray> receiver,
-                                 Handle<FixedArrayBase> backing_store,
-                                 uint32_t start, uint32_t delete_count,
-                                 Arguments args, uint32_t add_count) = 0;
-
  protected:
   friend class LookupIterator;
 

test/mjsunit/array-natives-elements.js

@@ -151,6 +151,7 @@ function array_natives_test() {
   assertTrue(%HasFastSmiElements(a3));
   assertEquals([1], a3r);
   assertEquals([2, 2, 3], a3);
+
   a3 = [1.1,2,3];
   a3r = a3.splice(0, 0);
   assertTrue(%HasFastDoubleElements(a3r));
@@ -165,12 +166,13 @@ function array_natives_test() {
   assertEquals([2, 3], a3);
   a3 = [1.1,2,3];
   a3r = a3.splice(0, 0, 2);
-  assertTrue(%HasFastDoubleElements(a3r));
+  // Commented out since handled in js, which takes the best fit.
+  // assertTrue(%HasFastDoubleElements(a3r));
+  assertTrue(%HasFastSmiElements(a3r));
   assertTrue(%HasFastDoubleElements(a3));
   assertEquals([], a3r);
   assertEquals([2, 1.1, 2, 3], a3);
   a3 = [1.1,2,3];
-  assertTrue(%HasFastDoubleElements(a3));
   a3r = a3.splice(0, 1, 2);
   assertTrue(%HasFastDoubleElements(a3r));
   assertTrue(%HasFastDoubleElements(a3));
@@ -178,7 +180,9 @@ function array_natives_test() {
   assertEquals([2, 2, 3], a3);
   a3 = [1.1,2,3];
   a3r = a3.splice(0, 0, 2.1);
-  assertTrue(%HasFastDoubleElements(a3r));
+  // Commented out since handled in js, which takes the best fit.
+  // assertTrue(%HasFastDoubleElements(a3r));
+  assertTrue(%HasFastSmiElements(a3r));
   assertTrue(%HasFastDoubleElements(a3));
   assertEquals([], a3r);
   assertEquals([2.1, 1.1, 2, 3], a3);
@@ -190,7 +194,9 @@ function array_natives_test() {
   assertEquals([2.2, 2, 3], a3);
   a3 = [1,2,3];
   a3r = a3.splice(0, 0, 2.1);
-  assertTrue(%HasFastDoubleElements(a3r));
+  // Commented out since handled in js, which takes the best fit.
+  // assertTrue(%HasFastDoubleElements(a3r));
+  assertTrue(%HasFastSmiElements(a3r));
   assertTrue(%HasFastDoubleElements(a3));
   assertEquals([], a3r);
   assertEquals([2.1, 1, 2, 3], a3);
@@ -200,6 +206,7 @@ function array_natives_test() {
   assertTrue(%HasFastDoubleElements(a3));
   assertEquals([1], a3r);
   assertEquals([2.2, 2, 3], a3);
+
   a3 = [{},2,3];
   a3r = a3.splice(0, 0);
   assertTrue(%HasFastObjectElements(a3r));
@@ -224,6 +231,7 @@ function array_natives_test() {
   assertTrue(%HasFastObjectElements(a3));
   assertEquals([1], a3r);
   assertEquals([{}, 2, 3], a3);
+
   a3 = [1.1,2,3];
   a3r = a3.splice(0, 0, {});
   assertTrue(%HasFastObjectElements(a3r));
@@ -236,35 +244,6 @@ function array_natives_test() {
   assertTrue(%HasFastObjectElements(a3));
   assertEquals([1.1], a3r);
   assertEquals([{}, 2, 3], a3);
-  // Splice large objects
-  var a3 = new Array(1024 * 1024);
-  a3[1024*1024-1] = 1;
-  var a3r;
-  a3r = a3.splice(-1, 1);
-  assertTrue(%HasFastSmiElements(a3r));
-  assertTrue(%HasFastSmiElements(a3));
-  assertEquals([1], a3r);
-  assertEquals(new Array(1024 * 1024 - 1), a3);
-  var a3 = new Array(1024 * 1024);
-  a3[0] = 1;
-  var a3r;
-  a3r = a3.splice(0, 1);
-  assertTrue(%HasFastSmiElements(a3r));
-  assertTrue(%HasFastSmiElements(a3));
-  assertEquals([1], a3r);
-  assertEquals(new Array(1024 * 1024 - 1), a3);
-  // Splice array with large enough backing store
-  a3 = [1.1, 2.2, 3.3];
-  a3r = a3.splice(2, 1);
-  assertTrue(%HasFastDoubleElements(a3r));
-  assertTrue(%HasFastDoubleElements(a3));
-  assertEquals([3.3], a3r);
-  assertEquals([1.1, 2.2], a3);
-  a3r = a3.splice(1, 1, 4.4, 5.5);
-  assertTrue(%HasFastDoubleElements(a3r));
-  assertTrue(%HasFastDoubleElements(a3));
-  assertEquals([2.2], a3r);
-  assertEquals([1.1, 4.4, 5.5], a3);
 
   // Pop
   var a4 = [1,2,3];

test/mjsunit/array-splice.js

@@ -115,11 +115,6 @@
     assertEquals([], array);
     assertEquals([1, 2, 3, 4, 5, 6, 7], spliced);
 
-    array = [1, 2, 3, 4, 5, 6, 7];
-    spliced = array.splice(-1e100);
-    assertEquals([], array);
-    assertEquals([1, 2, 3, 4, 5, 6, 7], spliced);
-
     array = [1, 2, 3, 4, 5, 6, 7];
     spliced = array.splice(-3);
     assertEquals([1, 2, 3, 4], array);
@@ -150,21 +145,11 @@
     assertEquals([1, 2, 3, 4, 5, 6, 7], array);
     assertEquals([], spliced);
 
-    array = [1, 2, 3, 4, 5, 6, 7];
-    spliced = array.splice(1e100);
-    assertEquals([1, 2, 3, 4, 5, 6, 7], array);
-    assertEquals([], spliced);
-
     array = [1, 2, 3, 4, 5, 6, 7];
     spliced = array.splice(0, -100);
     assertEquals([1, 2, 3, 4, 5, 6, 7], array);
     assertEquals([], spliced);
 
-    array = [1, 2, 3, 4, 5, 6, 7];
-    spliced = array.splice(0, -1e100);
-    assertEquals([1, 2, 3, 4, 5, 6, 7], array);
-    assertEquals([], spliced);
-
     array = [1, 2, 3, 4, 5, 6, 7];
     spliced = array.splice(0, -3);
     assertEquals([1, 2, 3, 4, 5, 6, 7], array);
@@ -195,11 +180,6 @@
     assertEquals([], array);
     assertEquals([1, 2, 3, 4, 5, 6, 7], spliced);
 
-    array = [1, 2, 3, 4, 5, 6, 7];
-    spliced = array.splice(0, 1e100);
-    assertEquals([], array);
-    assertEquals([1, 2, 3, 4, 5, 6, 7], spliced);
-
     // Some exotic cases.
     obj = { toString: function() { throw 'Exception'; } };