[array] Properly handle COW arrays in Array#sort

COW arrays were previously handled in the C++ pre-processing runtime
function.  The Torque version forgot a "EnsureWritableFastElements".
This CL fixes that.

Bug: chromium:967254
Change-Id: Ifbf89e57cfe724e61316b8abc226f7e8a262fce2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630675
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61835}

test/mjsunit/regress/regress-crbug-967254.js

@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test that fast COW arrays are properly handled by Array#sort.
+
+function COWSort() {
+  const array = ["cc", "c", "aa", "bb", "b", "ab", "ac"];
+  array.sort();
+  return array;
+}
+
+assertArrayEquals(["aa", "ab", "ac", "b", "bb", "c", "cc"], COWSort());
+
+Array.prototype.sort = () => {};
+
+assertArrayEquals(["cc", "c", "aa", "bb", "b", "ab", "ac"], COWSort());

third_party/v8/builtins/array-sort.tq

@@ -114,6 +114,9 @@ namespace array {
       GotoIfForceSlowPath() otherwise Slow;
       let a: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
 
+      // Copy copy-on-write (COW) arrays.
+      array::EnsureWriteableFastElements(a);
+
       const elementsKind: ElementsKind = map.elements_kind;
       if (IsDoubleElementsKind(elementsKind)) {
         loadFn = Load<FastDoubleElements>;