Revert "[typedarray] Properly convert hole to undefined in TypedArray.from"

This reverts commit ece86adc.

Reason for revert: Potential cause of auto-roller breakage https://ci.chromium.org/p/chromium/builders/luci.chromium.try/win10_chromium_x64_rel_ng/91864

Original change's description:
> [typedarray] Properly convert hole to undefined in TypedArray.from
> 
> It used to call the old IterableToList, which had the wrong
> semantics for holes.
> 
> Bug: v8:8133
> Change-Id: Idd5acd55a155bc43df7552135a44151bb2db38e9
> Reviewed-on: https://chromium-review.googlesource.com/1213204
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55745}

TBR=neis@chromium.org,petermarshall@chromium.org,dhai@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8133
Change-Id: I09b108e7844c598253fbbe02d705699c21308637
Reviewed-on: https://chromium-review.googlesource.com/1220286Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55802}

src/builtins/builtins-typed-array-gen.cc

@@ -1670,8 +1670,9 @@ TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
     // 7. If usingIterator is not undefined, then
     //  a. Let values be ? IterableToList(source, usingIterator).
     //  b. Let len be the number of elements in values.
-    TNode<JSArray> values = CAST(
-        CallBuiltin(Builtins::kIterableToList, context, source, iterator_fn));
+    TNode<JSArray> values =
+        CAST(CallBuiltin(Builtins::kIterableToListMayPreserveHoles, context,
+                         source, iterator_fn));
 
     // This is not a spec'd limit, so it doesn't particularly matter when we
     // throw the range error for typed array length > MaxSmi.

test/mjsunit/regress/regress-8133-1.js

-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-const arr = [1, , 3];
-
-function mapper(x) {
-  Array.prototype[1] = 2;
-  return x + 1;
-}
-
-// This iterates over arr using the iterator protocol, which turns the hole into
-// undefined.  The mapper function then gets called in a separate iteration over
-// the acquired elements, where it increments undefined, which produces NaN and
-// gets converted to 0.
-assertArrayEquals([2, 0, 4], Uint16Array.from(arr, mapper));

test/mjsunit/regress/regress-8133-2.js

-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-const arr = [1, , 3];
-
-function mapper(x) {
-  Array.prototype[1] = 2;
-  return x + 1;
-}
-
-// We force a direct iteration (using the array length, not the iterator
-// protocol). The mapper function gets called during this iteration, not in a
-// separate one. Hence when index 1 is read, 2 is retrieved from the prototype
-// and incremented to 3.
-Array.prototype[Symbol.iterator] = undefined;
-assertArrayEquals([2, 3, 4], Uint16Array.from(arr, mapper));