Remove broken optimization unwrapping number wrappers on setting array.length

src/accessors.cc

Index: src/accessors.cc
diff --git a/src/accessors.cc b/src/accessors.cc
index 5743c7552f1ae7539dec267a87b3bdd6b5c705f5..9850cd388e416549ddd43e81672f9688c58728b3 100644
--- a/src/accessors.cc
+++ b/src/accessors.cc
@@ -193,16 +193,7 @@ static bool FastAsArrayLength(Isolate* isolate, Handle<Object> value,
   // We don't support AsArrayLength, so use AsArrayIndex for now. This just
   // misses out on kMaxUInt32.
   if (value->IsString()) return String::cast(*value)->AsArrayIndex(length);
-  if (!value->IsJSValue()) return false;
-  Handle<JSValue> wrapper = Handle<JSValue>::cast(value);
-  DCHECK(wrapper->GetIsolate()
-             ->native_context()
-             ->number_function()
-             ->has_initial_map());
-  // Only support fast unwrapping for the initial map. Otherwise valueOf might
-  // have been overwritten, in which case unwrapping is invalid.
-  if (wrapper->map() != isolate->number_function()->initial_map()) return false;
-  return wrapper->value()->ToArrayIndex(length);
+  return false;
 }