[turbofan] Move Array.prototype.push/pop/shift lowering to JSCallReducer.

Bug: v8:7127, v8:7204, v8:7205
Change-Id: Idd3c11dc92fbd2c7ccab3aece7b2ad189619fc2c
Reviewed-on: https://chromium-review.googlesource.com/833916Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50337}

src/compiler/js-builtin-reducer.h

@@ -53,9 +53,7 @@ class V8_EXPORT_PRIVATE JSBuiltinReducer final
                                          IterationKind kind);
   Reduction ReduceTypedArrayToStringTag(Node* node);
   Reduction ReduceArrayIsArray(Node* node);
-  Reduction ReduceArrayPop(Node* node);
-  Reduction ReduceArrayPush(Node* node);
-  Reduction ReduceArrayShift(Node* node);
+
   Reduction ReduceCollectionIterator(Node* node,
                                      InstanceType collection_instance_type,
                                      int collection_iterator_map_index);

src/compiler/js-call-reducer.h

@@ -80,6 +80,9 @@ class JSCallReducer final : public AdvancedReducer {
   Reduction ReduceArrayFind(ArrayFindVariant variant,
                             Handle<JSFunction> function, Node* node);
   Reduction ReduceArrayEvery(Handle<JSFunction> function, Node* node);
+  Reduction ReduceArrayPrototypePush(Node* node);
+  Reduction ReduceArrayPrototypePop(Node* node);
+  Reduction ReduceArrayPrototypeShift(Node* node);
   Reduction ReduceCallOrConstructWithArrayLikeOrSpread(
       Node* node, int arity, CallFrequency const& frequency,
       VectorSlotPair const& feedback);