Reduce the chance Torque's Array.prototype.slice creates holey arrays.

Currently Torque's Array.prototype.slice creates holey arrays for those
that don't fit in new space in its slow path (by calling
ArraySpeciesCreate), even if the source is packed. This creates regression
on packed arrays where TurboFan optimizes and then deoptimizes because
the maps don't match.
See https://chromeperf.appspot.com/report?sid=4553b0826123337f5026fd6b4a285d5fc3cd77cafb515ddd954d195630642730

This CL reduces the chance that Torque's Array.prototype.slice returns
holey arrays. In particular, in the case of a large FastJSArray,
ExtractFastJSArray can still be used because it can handle large objects,
and will return a packed array if the source array is also packed.

Change-Id: I691cf48e07c699e5d42afda0bea6cbdc117b653f
Reviewed-on: https://chromium-review.googlesource.com/c/1293372Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Hai Dang <dhai@google.com>
Cr-Commit-Position: refs/heads/master@{#56879}

src/builtins/array-slice.tq

@@ -7,6 +7,9 @@ module array {
       context: Context, args: JSArgumentsObjectWithLength, start: Smi,
       count: Smi): JSArray
       labels Bailout {
+    // If the resulting array doesn't fit in new space, use the slow path.
+    if (count >= kMaxNewSpaceFixedArrayElements) goto Bailout;
+
     const end: Smi = start + count;
     const sourceElements: FixedArray =
         Cast<FixedArray>(args.elements) otherwise Bailout;
@@ -27,6 +30,9 @@ module array {
       context: Context, args: JSArgumentsObjectWithLength, start: Smi,
       count: Smi): JSArray
       labels Bailout {
+    // If the resulting array doesn't fit in new space, use the slow path.
+    if (count >= kMaxNewSpaceFixedArrayElements) goto Bailout;
+
     const sloppyElements: SloppyArgumentsElements =
         Cast<SloppyArgumentsElements>(args.elements) otherwise Bailout;
     const sloppyElementsLength: Smi = sloppyElements.length;
@@ -83,9 +89,6 @@ module array {
     const count: Smi = Cast<Smi>(countNumber) otherwise Bailout;
     assert(start >= 0);
 
-    // If the resulting array doesn't fit in new space, use the slow path.
-    if (count >= kMaxNewSpaceFixedArrayElements) goto Bailout;
-
     typeswitch (o) {
       case (a: FastJSArrayForCopy): {
         // It's possible to modify the array length from a valueOf