Make (Object.)observed Arrays use SafeRemoveArrayHoles during sort

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 99fd8e21f0a6dfd0ba2019289caf06c770f241a0..85ac44b0999e29949e3ee6df5f4cb8a1e127f86d 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -13755,12 +13755,13 @@ MaybeObject* JSObject::PrepareSlowElementsForSort(uint32_t limit) {
 MaybeObject* JSObject::PrepareElementsForSort(uint32_t limit) {
   Heap* heap = GetHeap();
 
+  ASSERT(!map()->is_observed());
   if (HasDictionaryElements()) {
     // Convert to fast elements containing only the existing properties.
     // Ordering is irrelevant, since we are going to sort anyway.
     SeededNumberDictionary* dict = element_dictionary();
     if (IsJSArray() || dict->requires_slow_elements() ||
-        dict->max_number_key() >= limit || map()->is_observed()) {
+        dict->max_number_key() >= limit) {
       return PrepareSlowElementsForSort(limit);
     }
     // Convert to fast elements.