X87: [runtime] Introduce a proper %NewArray runtime entry.

  port ceade6cf (r32131)

  original commit message:
  This adds a new %NewArray runtime entry, which constructs a new JSArray
  and does the subclassing correctly (to the same degree that %NewObject
  does currently), and also deals properly with the AllocationSite
  feedback mechanism. This runtime entry will be used by TurboFan and is
  also used as a fallback in the subclassing case in the stub currently.

BUG=

Review URL: https://codereview.chromium.org/1462283003

Cr-Commit-Position: refs/heads/master@{#32160}

src/x87/code-stubs-x87.cc

@@ -4701,27 +4701,26 @@ void ArrayConstructorStub::Generate(MacroAssembler* masm) {
 
   // Subclassing.
   __ bind(&subclassing);
-  __ pop(ecx);  // return address.
-  __ push(edi);
-  __ push(edx);
-
-  // Adjust argc.
   switch (argument_count()) {
     case ANY:
     case MORE_THAN_ONE:
-      __ add(eax, Immediate(2));
+      __ mov(Operand(esp, eax, times_pointer_size, kPointerSize), edi);
+      __ add(eax, Immediate(3));
       break;
     case NONE:
-      __ mov(eax, Immediate(2));
+      __ mov(Operand(esp, 1 * kPointerSize), edi);
+      __ mov(eax, Immediate(3));
       break;
     case ONE:
-      __ mov(eax, Immediate(3));
+      __ mov(Operand(esp, 2 * kPointerSize), edi);
+      __ mov(eax, Immediate(4));
       break;
   }
-
-  __ push(ecx);
-  __ JumpToExternalReference(
-      ExternalReference(Runtime::kArrayConstructorWithSubclassing, isolate()));
+  __ PopReturnAddressTo(ecx);
+  __ Push(edx);
+  __ Push(ebx);
+  __ PushReturnAddressFrom(ecx);
+  __ JumpToExternalReference(ExternalReference(Runtime::kNewArray, isolate()));
 }