Port 5bd48324

Original commit message:
    Introduce a new Apply builtin that forms a correct and optimizable
    foundation for the Function.prototype.apply, Reflect.construct and
    Reflect.apply builtins (which properly does the PrepareForTailCall
    as required by the ES2015 spec).

    The new Apply builtin avoids going to the runtime if it is safe to
    just access the backing store elements of the argArray, i.e. if you
    pass a JSArray with no holes, or an unmapped, unmodified sloppy or
    strict arguments object.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4413, v8:4430
LOG=n

Review URL: https://codereview.chromium.org/1533073003

Cr-Commit-Position: refs/heads/master@{#32974}