Revert "Fix Array.prototype.sort speed regression"

This reverts commit c88994f8.

Reason for revert: Seems to break AccessibilitySelectionTest.List in webkit_unit_tests (https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Mac/15618)

Original change's description:
> Fix Array.prototype.sort speed regression
> 
> CanUseSameAccessor<ElementsAccessor: type> is array-sort.tq is super
> performance-critical. Reverting the type-safe cleanup made in this
> function while landing Array.prototype.slice.
> 
> Bug=chromium:852764
> 
> Change-Id: I1252d2ff8e431581f916794807e59abb39248abb
> Reviewed-on: https://chromium-review.googlesource.com/c/1317815
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Daniel Clifford <danno@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57248}

TBR=danno@chromium.org,jgruber@chromium.org

Change-Id: Ie447fd0382fee344326d928398595aa450ccdcca
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1319577Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57265}

third_party/v8/builtins/array-sort.tq

@@ -325,12 +325,12 @@ module array {
   builtin CanUseSameAccessor<ElementsAccessor: type>(
       context: Context, receiver: JSReceiver, initialReceiverMap: Object,
       initialReceiverLength: Number): Boolean {
-    const a: JSArray = UnsafeCast<JSArray>(receiver);
+    const a: JSArray = Cast<JSArray>(receiver) otherwise unreachable;
     if (a.map != initialReceiverMap) return False;
 
     assert(TaggedIsSmi(initialReceiverLength));
     let originalLength: Smi = UnsafeCast<Smi>(initialReceiverLength);
-    if (UnsafeCast<Smi>(a.length) != originalLength) return False;
+    if (a.length != originalLength) return False;
 
     return True;
   }