lib: add SafeArray to primordials and use it for FreeList

[ExE-Boss]

Refs: #36304 (comment)
Refs: #36565

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• tests and/or benchmarks are included
• commit message follows commit guidelines

[Lxxyx]

Run Benchmark on my computer, seems the performance issues still exists.

                           confidence improvement accuracy (*)    (**)   (***)
 misc/freelist.js n=100000        ***    -92.46 %      ±1.94% ±2.61% ±3.46%

Be aware that when doing many comparisons the risk of a false-positive
result increases. In this case there are 1 comparisons, you can thus
expect the following amount of false-positive results:
  0.05 false positives, when considering a   5% risk acceptance (*, **, ***),
  0.01 false positives, when considering a   1% risk acceptance (**, ***),
  0.00 false positives, when considering a 0.1% risk acceptance (***)

[aduh95]

Benchmark CI: https://ci.nodejs.org/view/Node.js%20benchmark/job/benchmark-node-micro-benchmarks/784/

[ExE-Boss]

Looks like the benchmark CI crashed: https://ci.nodejs.org/view/Node.js%20benchmark/job/benchmark-node-micro-benchmarks/783/console

[aduh95]

Benchmark confirmed very poor performance results…

                            confidence improvement accuracy (*)   (**)  (***)
 misc/freelist.js n=100000        ***    -91.36 %       ±3.89% ±5.24% ±6.96%

[ExE-Boss]

If I had to guess, I’d say V8 is doing some inlining shenanigans when it detects a push or pop method on an ordinary array with %Array.prototype% in its [[Prototype]] internal slot.

---

By inlining the methods in #37649, I hope to make FreeList faster and resilient to mutation of %Array.prototype%.pop and %Array.prototype%.push

[github-actions]

This pull request has been marked as stale due to 90 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.