Fix ArrayConcat length estimation for TypedArrays

TypedArrays cannot be handled on the JSArray path.
This patch should provide a minor performance improvement while
being functionally non-observable.

Change-Id: I05259517b9079aa715b3cf4be9b0cf6bb47236ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948712
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65419}

src/builtins/builtins-array.cc

@@ -863,11 +863,10 @@ uint32_t EstimateElementCount(Isolate* isolate, Handle<JSArray> array) {
       break;
     }
 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype) case TYPE##_ELEMENTS:
-
       TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
-      // External arrays are always dense.
-      return length;
+      // JSArrays never have typed elements.
+      UNREACHABLE();
     case NO_ELEMENTS:
       return 0;
     case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
@@ -944,15 +943,17 @@ void CollectElementIndices(Isolate* isolate, Handle<JSObject> object,
       TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
       {
-        // TODO(bmeurer, v8:4153): Change this to size_t later.
-        uint32_t length =
-            static_cast<uint32_t>(Handle<JSTypedArray>::cast(object)->length());
+        size_t length = Handle<JSTypedArray>::cast(object)->length();
+        // We are only interested in the first {range} elements, so any
+        // additional elements in the typed array can be safely ignored.
         if (range <= length) {
           length = range;
           // We will add all indices, so we might as well clear it first
           // and avoid duplicates.
           indices->clear();
         }
+        // {range} puts a cap on {length}.
+        DCHECK_LE(length, std::numeric_limits<uint32_t>::max());
         for (uint32_t i = 0; i < length; i++) {
           indices->push_back(i);
         }
@@ -1232,6 +1233,11 @@ Object Slow_ArrayConcat(BuiltinArguments* args, Handle<Object> species,
         kind = GetMoreGeneralElementsKind(kind, array_kind);
       }
       element_estimate = EstimateElementCount(isolate, array);
+    } else if (obj->IsJSTypedArray()) {
+      size_t raw_length = Handle<JSTypedArray>::cast(obj)->length();
+      length_estimate = static_cast<uint32_t>(std::min(
+          raw_length, static_cast<size_t>(JSObject::kMaxElementCount)));
+      element_estimate = length_estimate;
     } else {
       if (obj->IsHeapObject()) {
         kind = GetMoreGeneralElementsKind(