Bisected to r531679 "Update V8 to version 6.6.61."
Landed in 66.0.3331.0

In V8 log tentatively suspecting 181ac2b0dcb18bc22fd119b5e228ed86b8337dc6
"[ic] Improve performance of KeyedStoreIC on literal-based arrays."

Able to reproduce the issue on Windows 10, mac 10.13.3 and Ubuntu 17.10 using chrome latest stable #68.0.3440.75 and latest canary #70.0.3508.0.

Bisect Information:
=====================
Good build: 66.0.3330.0
Bad Build : 66.0.3331.0

As per comment #1, suspecting below change
Change-Id: I6a15e8c1ff8d4ad4d5b8fc447745dce5d146c67c
Reviewed-on: https://chromium-review.googlesource.com/876014

neis@ - Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks...!!

Thanks for the report. The bug exists already before my change, as
demonstrated by a variant of the example where "[1,2,3,4]" is replaced
by "[1,2,3,4].slice()". I suspect it has been around for a long time.

re #c5: since at least Chrome 30, indeed.
It changed in r334361 (M-45): https://chromium.googlesource.com/v8/v8/+log/c292930e..5105add5?pretty=fuller
Before that the modified script produced 1,2,3,4,0 two times, after that the output is same as in modern builds.
In r334361 changelog 89b9a2cfb317e52186f682c91502b22932d52db3 might be related.

Here's the modified script with __proto__ assignment for the ancient Chromium builds.

    function f() {
        var x = [1,2,3,4].slice();
        x[4] = 0;
        console.log(String(x));
    }
    Array.prototype.__proto__ = new Int8Array(4);
    f();
    f();

Assigning to the IC experts.