JSArray::canFastCopy() should fail if the source and destination arrays are the same.

JSArray::canFastCopy() should fail if the source and destination arrays are the same.
https://bugs.webkit.org/show_bug.cgi?id=177584
<rdar://problem/34463903>

Reviewed by Saam Barati.

JSTests:

* stress/regress-177584.js: Added.
(assertEqual):
(Array.prototype.Symbol.species):

Source/JavaScriptCore:

If the source and destination arrays are the same, we may be copying overlapping
regions.  Hence, we need to take the slow path.

* runtime/JSArrayInlines.h:
(JSC::JSArray::canFastCopy):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@222598 268f45cc-cd09-0410-ab3c-d52691b4dbfc