Reland "Fix Array.prototype.sort speed regression"

This is a reland of c88994f8

Turned out to not be the issue.

Original change's description:
> Fix Array.prototype.sort speed regression
>
> CanUseSameAccessor<ElementsAccessor: type> is array-sort.tq is super
> performance-critical. Reverting the type-safe cleanup made in this
> function while landing Array.prototype.slice.
>
> Bug=chromium:852764
>
> Change-Id: I1252d2ff8e431581f916794807e59abb39248abb
> Reviewed-on: https://chromium-review.googlesource.com/c/1317815
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Daniel Clifford <danno@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57248}

TBR=danno@chromium.org

Change-Id: I627a131a8525ae4e131c6467561cab9832f3792f
Reviewed-on: https://chromium-review.googlesource.com/c/1319581Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57270}

third_party/v8/builtins/array-sort.tq

@@ -325,12 +325,12 @@ module array {
   builtin CanUseSameAccessor<ElementsAccessor: type>(
       context: Context, receiver: JSReceiver, initialReceiverMap: Object,
       initialReceiverLength: Number): Boolean {
-    const a: JSArray = Cast<JSArray>(receiver) otherwise unreachable;
+    const a: JSArray = UnsafeCast<JSArray>(receiver);
     if (a.map != initialReceiverMap) return False;
 
     assert(TaggedIsSmi(initialReceiverLength));
     let originalLength: Smi = UnsafeCast<Smi>(initialReceiverLength);
-    if (a.length != originalLength) return False;
+    if (UnsafeCast<Smi>(a.length) != originalLength) return False;
 
     return True;
   }