Fix Array.prototype.sort speed regression

CanUseSameAccessor<ElementsAccessor: type> is array-sort.tq is super
performance-critical. Reverting the type-safe cleanup made in this
function while landing Array.prototype.slice.

Bug=chromium:852764

Change-Id: I1252d2ff8e431581f916794807e59abb39248abb
Reviewed-on: https://chromium-review.googlesource.com/c/1317815Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57248}

third_party/v8/builtins/array-sort.tq

@@ -325,12 +325,12 @@ module array {
   builtin CanUseSameAccessor<ElementsAccessor: type>(
       context: Context, receiver: JSReceiver, initialReceiverMap: Object,
       initialReceiverLength: Number): Boolean {
-    const a: JSArray = Cast<JSArray>(receiver) otherwise unreachable;
+    const a: JSArray = UnsafeCast<JSArray>(receiver);
     if (a.map != initialReceiverMap) return False;
 
     assert(TaggedIsSmi(initialReceiverLength));
     let originalLength: Smi = UnsafeCast<Smi>(initialReceiverLength);
-    if (a.length != originalLength) return False;
+    if (UnsafeCast<Smi>(a.length) != originalLength) return False;
 
     return True;
   }