Revert "Fix ArrayConcat length estimation for TypedArrays"

This reverts commit 5f8e95c1.

Reason for revert: crbug.com/1033418. TypedArrays are not, by default, concat-spreadable; the existing code is inconsistent and this CL didn't update/fix enough of it.

Original change's description:
> Fix ArrayConcat length estimation for TypedArrays
>
> TypedArrays cannot be handled on the JSArray path.
> This patch should provide a minor performance improvement while
> being functionally non-observable.
>
> Change-Id: I05259517b9079aa715b3cf4be9b0cf6bb47236ac
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948712
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65419}

TBR=jkummerow@chromium.org,ishell@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1033418
Change-Id: I345c8ebc38be6df42d5bdbecd0d06d19967ad6f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1967324
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65447}

src/builtins/builtins-array.cc

@@ -863,10 +863,11 @@ uint32_t EstimateElementCount(Isolate* isolate, Handle<JSArray> array) {
       break;
     }
 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype) case TYPE##_ELEMENTS:
+
       TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
-      // JSArrays never have typed elements.
-      UNREACHABLE();
+      // External arrays are always dense.
+      return length;
     case NO_ELEMENTS:
       return 0;
     case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
@@ -943,17 +944,15 @@ void CollectElementIndices(Isolate* isolate, Handle<JSObject> object,
       TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
       {
-        size_t length = Handle<JSTypedArray>::cast(object)->length();
-        // We are only interested in the first {range} elements, so any
-        // additional elements in the typed array can be safely ignored.
+        // TODO(bmeurer, v8:4153): Change this to size_t later.
+        uint32_t length =
+            static_cast<uint32_t>(Handle<JSTypedArray>::cast(object)->length());
         if (range <= length) {
           length = range;
           // We will add all indices, so we might as well clear it first
           // and avoid duplicates.
           indices->clear();
         }
-        // {range} puts a cap on {length}.
-        DCHECK_LE(length, std::numeric_limits<uint32_t>::max());
         for (uint32_t i = 0; i < length; i++) {
           indices->push_back(i);
         }
@@ -1233,11 +1232,6 @@ Object Slow_ArrayConcat(BuiltinArguments* args, Handle<Object> species,
         kind = GetMoreGeneralElementsKind(kind, array_kind);
       }
       element_estimate = EstimateElementCount(isolate, array);
-    } else if (obj->IsJSTypedArray()) {
-      size_t raw_length = Handle<JSTypedArray>::cast(obj)->length();
-      length_estimate = static_cast<uint32_t>(std::min(
-          raw_length, static_cast<size_t>(JSObject::kMaxElementCount)));
-      element_estimate = length_estimate;
     } else {
       if (obj->IsHeapObject()) {
         kind = GetMoreGeneralElementsKind(