Reland "[elements] Improve Array.prototype.splice speed"

This reverts commit 9a7c4bfe.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> Revert "[elements] Improve Array.prototype.splice speed"
> 
> This reverts commit dcdabdc8.
> 
> Reason for revert: broke tsan.
> 
> Original change's description:
> > [elements] Improve Array.prototype.splice speed
> > 
> > By using memmove for SMI elements we get a roughly 3x speedup over the slower
> > iterative copying with write barriers.
> > 
> > Bug: chromium:835558
> > Change-Id: I73da07a1648a3495ff78212ffa1ed949d205a7d2
> > Reviewed-on: https://chromium-review.googlesource.com/1028236
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#52792}
> 
> TBR=cbruni@chromium.org,ishell@chromium.org
> 
> Change-Id: I77c46fe3d47d651de3c39df9fbf5f30c340188e2
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: chromium:835558
> Reviewed-on: https://chromium-review.googlesource.com/1028337
> Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52795}

TBR=kozyatinskiy@chromium.org,cbruni@chromium.org,ishell@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:835558
Change-Id: I57aedb3536b81c97cf4e7ab6d863aa1dc24c20b4
Reviewed-on: https://chromium-review.googlesource.com/1032743Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52857}

src/elements.cc

@@ -117,6 +117,11 @@ MaybeHandle<Object> ThrowArrayLengthRangeError(Isolate* isolate) {
                   Object);
 }
 
+WriteBarrierMode GetWriteBarrierMode(ElementsKind kind) {
+  if (IsSmiElementsKind(kind)) return SKIP_WRITE_BARRIER;
+  if (IsDoubleElementsKind(kind)) return SKIP_WRITE_BARRIER;
+  return UPDATE_WRITE_BARRIER;
+}
 
 void CopyObjectToObjectElements(FixedArrayBase* from_base,
                                 ElementsKind from_kind, uint32_t from_start,
@@ -188,8 +193,7 @@ static void CopyDictionaryToObjectElements(
   if (to_start + copy_size > to_length) {
     copy_size = to_length - to_start;
   }
-  WriteBarrierMode write_barrier_mode =
-      IsObjectElementsKind(to_kind) ? UPDATE_WRITE_BARRIER : SKIP_WRITE_BARRIER;
+  WriteBarrierMode write_barrier_mode = GetWriteBarrierMode(to_kind);
   Isolate* isolate = from->GetIsolate();
   for (int i = 0; i < copy_size; i++) {
     int entry = from->FindEntry(isolate, i + from_start);
@@ -2280,8 +2284,9 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
                 dst_elms->data_start() + src_index, len * kDoubleSize);
       } else {
         DisallowHeapAllocation no_gc;
+        WriteBarrierMode mode = GetWriteBarrierMode(KindTraits::Kind);
         heap->MoveElements(FixedArray::cast(*dst_elms), dst_index, src_index,
-                           len);
+                           len, mode);
       }
     }
     if (hole_start != hole_end) {

src/heap/heap.cc

@@ -1492,9 +1492,8 @@ void Heap::StartIdleIncrementalMarking(
                           gc_callback_flags);
 }
 
-
 void Heap::MoveElements(FixedArray* array, int dst_index, int src_index,
-                        int len) {
+                        int len, WriteBarrierMode mode) {
   if (len == 0) return;
 
   DCHECK(array->map() != fixed_cow_array_map());
@@ -1515,6 +1514,7 @@ void Heap::MoveElements(FixedArray* array, int dst_index, int src_index,
   } else {
     MemMove(dst, src, len * kPointerSize);
   }
+  if (mode == SKIP_WRITE_BARRIER) return;
   FIXED_ARRAY_ELEMENTS_WRITE_BARRIER(this, array, dst_index, len);
 }
 

src/heap/heap.h

@@ -763,7 +763,8 @@ class Heap {
 
   // Move len elements within a given array from src_index index to dst_index
   // index.
-  void MoveElements(FixedArray* array, int dst_index, int src_index, int len);
+  void MoveElements(FixedArray* array, int dst_index, int src_index, int len,
+                    WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   // Initialize a filler object to keep the ability to iterate over the heap
   // when introducing gaps within pages. If slots could have been recorded in