[array] Add regression test that causes left trimming while sorting

This CL adds a regression test that will check that the elements
pointer is properly reloaded after the JavaScript comparison
function is called during Array.p.sort.

R=jgruber@chromium.org

Bug: chromium:859809
Change-Id: I15f55fcc1906bd8d0751596e5457367a643b92da
Reviewed-on: https://chromium-review.googlesource.com/1124475
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54174}

test/mjsunit/regress/regress-crbug-859809.js

@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+let xs = [];
+const kSize = 200;
+for (let i = 0; i < kSize; ++i) {
+  xs.push(i);
+}
+
+let counter = 0;
+xs.sort((a, b) => {
+  if (counter++ % 10 == 0) {
+    xs.shift();
+    gc();
+  }
+
+  return a - b;
+});