Change CloneFastJSArray to use ExtractFixedArray.

This makes CloneFastJSArray allocate exact memory needed for the elements
to be copy, instead of over-allocating.

Bug: chromium:875723
Change-Id: Id8e14cff3caf42eb0fb4090ec755f1cadcf518e6
Reviewed-on: https://chromium-review.googlesource.com/1180893
Commit-Queue: Hai Dang <dhai@google.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55246}

src/code-stub-assembler.cc

@@ -3844,17 +3844,19 @@ Node* CodeStubAssembler::ExtractFastJSArray(Node* context, Node* array,
 Node* CodeStubAssembler::CloneFastJSArray(Node* context, Node* array,
                                           ParameterMode mode,
                                           Node* allocation_site) {
-  Node* length = LoadJSArrayLength(array);
-  Node* elements = LoadElements(array);
-
   Node* original_array_map = LoadMap(array);
   Node* elements_kind = LoadMapElementsKind(original_array_map);
 
-  Node* new_elements = CloneFixedArray(elements);
+  Node* length = LoadJSArrayLength(array);
+  Node* new_elements = ExtractFixedArray(
+      LoadElements(array), IntPtrOrSmiConstant(0, mode),
+      TaggedToParameter(length, mode), nullptr,
+      ExtractFixedArrayFlag::kAllFixedArraysDontCopyCOW, mode);
 
   // Use the cannonical map for the Array's ElementsKind
   Node* native_context = LoadNativeContext(context);
   Node* array_map = LoadJSArrayElementsMap(elements_kind, native_context);
+
   Node* result = AllocateUninitializedJSArrayWithoutElements(array_map, length,
                                                              allocation_site);
   StoreObjectField(result, JSObject::kElementsOffset, new_elements);