JSArray can go slow case during String.split. Guard against

src/runtime.cc

Index: src/runtime.cc
===================================================================
--- src/runtime.cc	(revision 9164)
+++ src/runtime.cc	(working copy)
@@ -6091,11 +6091,13 @@
   }
 
   if (limit == 0xffffffffu) {
-    StringSplitCache::Enter(isolate->heap(),
-                            isolate->heap()->string_split_cache(),
-                            *subject,
-                            *pattern,
-                            *elements);
+    if (result->HasFastElements()) {
+      StringSplitCache::Enter(isolate->heap(),
+                              isolate->heap()->string_split_cache(),
+                              *subject,
+                              *pattern,
+                              *elements);
+    }
   }
 
   return *result;