lib: inline Array operations in FreeList methods

[ExE-Boss]

This inlines a simplified behaviour of %Array.prototype.pop% and %Array.prototype.push% in FreeList’s methods and sets the prototype of the list to null so that OrdinarySetWithOwnDescriptor doesn’t walk up the prototype chain.

This avoids depending on user code not mutating %Array.prototype%.pop and %Array.prototype%.push.

---

Refs: #36565
Refs: #36600

If I had to guess, I’d say V8 is doing some inlining shenanigans when it detects a push or pop method on an ordinary array with %Array.prototype% in its [[Prototype]] internal slot.

---

/cc @aduh95 @Lxxyx

[aduh95]

Benchmark CI: https://ci.nodejs.org/view/Node.js%20benchmark/job/benchmark-node-micro-benchmarks/957/

Benchmark results still show regression:

                         confidence improvement accuracy (*)   (**)  (***)
misc/freelist.jsn=100000        ***    -86.53 %       ±1.04% ±1.40% ±1.84%

[mscdex]

You might see if avoiding the destructuring assignments helps with the perf regressions. I know at one point it was significantly slower.

[aduh95]

Benchmark CI: https://ci.nodejs.org/view/Node.js%20benchmark/job/benchmark-node-micro-benchmarks/959/

                          confidence improvement accuracy (*)   (**)  (***)
 misc/freelist.jsn=100000        ***    -90.38 %       ±1.42% ±1.91% ±2.53%

[Mifrill]

@ExE-Boss I see in #36600 you using SafeArray:
https://github.com/ExE-Boss/node/blob/283189fcce72f98f55d335292db0b3b77a252279/lib/internal/freelist.js#L13

To me it seems the intention is the same to ensures that the array used is not affected by any potential modifications to the standard Array.prototype in user code or other libraries. I think it's great, and this is about maintaining encapsulation and avoiding unexpected side effects caused by changes to global prototypes.

Could you please kindly clarify what's the difference?

[ExE-Boss]

The difference is largely performance, as #36600 has a -91% perf regression, and this only has a -90%.