Revert of [typedarrays] remove invalid optimization in NAMEConstructor()...

Revert of [typedarrays] remove invalid optimization in NAMEConstructor() (patchset #1 id:1 of https://codereview.chromium.org/2544503002/ )

Reason for revert:
Speculative revert for causing timeouts on Win Debug gpu fyi bot

Nothing else looks even remotely relevant in the list of changes.
Will reland if this doesn't fix the issues.

BUG=670396

Original issue's description:
> [typedarrays] remove invalid optimization in NAMEConstructor()
>
> Before, we were treating objects with the builtin ArrayValues iterator
> method as array-like, where the iterator would iterate through to the
> full length of the object.
>
> This optimization was not sound, because it does not ensure that the
> next method hasn't been modified. Even if it hasn't been modified,
> it's entirely possible to be modified during iteration. Thus, this
> optimization has been removed due to its observability.
>
> BUG=v8:5699
> R=littledan@chromium.org, cbruni@chromium.org
>
> Committed: https://crrev.com/77df8c67d9609ada3b7d79e8e6d33f198bbad5a1
> Cr-Commit-Position: refs/heads/master@{#41394}

TBR=cbruni@chromium.org,littledan@chromium.org,caitp@igalia.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5699

Review-Url: https://codereview.chromium.org/2548583003
Cr-Commit-Position: refs/heads/master@{#41461}

src/js/typedarray.js

@@ -260,7 +260,7 @@ function NAMEConstructor(arg1, arg2, arg3) {
       NAMEConstructByTypedArray(this, arg1);
     } else if (IS_RECEIVER(arg1)) {
       var iteratorFn = arg1[iteratorSymbol];
-      if (IS_UNDEFINED(iteratorFn)) {
+      if (IS_UNDEFINED(iteratorFn) || iteratorFn === ArrayValues) {
         NAMEConstructByArrayLike(this, arg1, arg1.length);
       } else {
         NAMEConstructByIterable(this, arg1, iteratorFn);

test/mjsunit/es6/typedarray.js

@@ -334,31 +334,6 @@ function TestTypedArray(constr, elementSize, typicalElement) {
   assertEquals(0, genArr[0]);
   assertEquals(9, genArr[9]);
   assertEquals(1, iteratorReadCount);
-
-  // Modified %ArrayIteratorPrototype%.next() method is honoured (v8:5699)
-  const ArrayIteratorPrototype = Object.getPrototypeOf([][Symbol.iterator]());
-  const ArrayIteratorPrototypeNext = ArrayIteratorPrototype.next;
-  ArrayIteratorPrototype.next = function() {
-    return { done: true };
-  };
-  genArr = new constr([1, 2, 3]);
-  assertEquals(0, genArr.length);
-  ArrayIteratorPrototype.next = ArrayIteratorPrototypeNext;
-
-  // Modified %ArrayIteratorPrototype%.next() during iteration is honoured as
-  // well.
-  genArr = new constr(Object.defineProperty([1, , 3], 1, {
-    get() {
-      ArrayIteratorPrototype.next = function() {
-        return { done: true };
-      }
-      return 2;
-    }
-  }));
-  assertEquals(2, genArr.length);
-  assertEquals(1, genArr[0]);
-  assertEquals(2, genArr[1]);
-  ArrayIteratorPrototype.next = ArrayIteratorPrototypeNext;
 }
 
 TestTypedArray(Uint8Array, 1, 0xFF);