Reland "[array] Change QuickSort to TimSort for Array.p.sort"

This is a reland of 6bb82368

Original change's description:
> [array] Change QuickSort to TimSort for Array.p.sort
> 
> Bug: v8:7382
> Change-Id: I7f125a62867eb586d2720a2c641fb5f4012b284d
> Reviewed-on: https://chromium-review.googlesource.com/1100881
> Commit-Queue: Simon Zünd <szuend@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53838}

Bug: v8:7382
Change-Id: I499d782feaeb36df154e00a11d3b03cd41442347
Reviewed-on: https://chromium-review.googlesource.com/1107497Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#53864}

src/builtins/base.tq

@@ -233,7 +233,9 @@ extern operator '!=' macro WordNotEqual(Object, Object): bool;
 
 extern operator '+' macro SmiAdd(Smi, Smi): Smi;
 extern operator '-' macro SmiSub(Smi, Smi): Smi;
+extern operator '*' macro SmiMul(Smi, Smi): Smi;
 extern operator '&' macro SmiAnd(Smi, Smi): Smi;
+extern operator '|' macro SmiOr(Smi, Smi): Smi;
 extern operator '>>>' macro SmiShr(Smi, constexpr int31): Smi;
 
 extern operator '+' macro IntPtrAdd(intptr, intptr): intptr;
@@ -658,6 +660,7 @@ extern macro IsJSArray(HeapObject): bool;
 extern macro TaggedIsCallable(Object): bool;
 extern macro IsDetachedBuffer(JSArrayBuffer): bool;
 extern macro IsHeapNumber(HeapObject): bool;
+extern macro IsFixedArray(HeapObject): bool;
 extern macro IsExtensibleMap(Map): bool;
 extern macro IsCustomElementsReceiverInstanceType(int32): bool;
 

src/builtins/builtins-array-gen.cc

@@ -381,6 +381,26 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
 
   void ArrayBuiltinsAssembler::NullPostLoopAction() {}
 
+  void ArrayBuiltinsAssembler::FillFixedArrayWithZero(TNode<FixedArray> array,
+                                                      TNode<Smi> smi_length) {
+    TNode<IntPtrT> length = SmiToIntPtr(smi_length);
+    TNode<WordT> byte_length = WordShl(length, kPointerSizeLog2);
+    CSA_ASSERT(this, UintPtrLessThan(length, byte_length));
+
+    static const int32_t fa_base_data_offset =
+        FixedArray::kHeaderSize - kHeapObjectTag;
+    TNode<IntPtrT> backing_store = IntPtrAdd(
+        BitcastTaggedToWord(array), IntPtrConstant(fa_base_data_offset));
+
+    // Call out to memset to perform initialization.
+    TNode<ExternalReference> memset =
+        ExternalConstant(ExternalReference::libc_memset_function());
+    STATIC_ASSERT(kSizetSize == kIntptrSize);
+    CallCFunction3(MachineType::Pointer(), MachineType::Pointer(),
+                   MachineType::IntPtr(), MachineType::UintPtr(), memset,
+                   backing_store, IntPtrConstant(0), byte_length);
+  }
+
   void ArrayBuiltinsAssembler::ReturnFromBuiltin(Node* value) {
     if (argc_ == nullptr) {
       Return(value);

src/builtins/builtins-array-gen.h

@@ -77,6 +77,9 @@ class ArrayBuiltinsAssembler : public BaseBuiltinsFromDSLAssembler {
     return StoreFixedArrayElement(array, index, value);
   }
 
+  // Uses memset to effectively initialize the given FixedArray with Smi zeroes.
+  void FillFixedArrayWithZero(TNode<FixedArray> array, TNode<Smi> smi_length);
+
  protected:
   TNode<Context> context() { return context_; }
   TNode<Object> receiver() { return receiver_; }