[builtins] Widen fast path for IterableToList

When TypedArray builtin code was still in JS, we used to completely
elide IterableToList when passed an array. This meant that it was
possible for the builtins to observe side-effects which mutated the
array when that should have been impossible.

When IterableToList was ported to CSA, it changed to clone the passed-in
array instead of passing it through. This means that there's now no
need to guard against side-effects due to ToNumber conversions, so we
can simply return the result of Object::IterationHasObservableEffects.

Though no test changes are included here, this code is covered
by the regression tests added previously when this runtime function
was added (and later modified).

This still leaves a future TODO to port IterationHasObservableEffects
to CSA.

Change-Id: If913c035b124ecb59a5f647344b653429a162a2b
Reviewed-on: https://chromium-review.googlesource.com/1159733Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54876}

src/runtime/runtime-object.cc

@@ -1246,18 +1246,6 @@ RUNTIME_FUNCTION(Runtime_IterableToListCanBeElided) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, obj, 0);
-
-  // If an iterator symbol is added to the Number prototype, we could see a Smi.
-  if (obj->IsSmi()) return isolate->heap()->ToBoolean(false);
-  if (!HeapObject::cast(*obj)->IsJSObject()) {
-    return isolate->heap()->ToBoolean(false);
-  }
-
-  // While iteration alone may not have observable side-effects, calling
-  // toNumber on an object will. Make sure the arg is not an array of objects.
-  ElementsKind kind = JSObject::cast(*obj)->GetElementsKind();
-  if (!IsFastNumberElementsKind(kind)) return isolate->heap()->ToBoolean(false);
-
   return isolate->heap()->ToBoolean(!obj->IterationHasObservableEffects());
 }