[SAB] Fix {newtarget-prototype-is-not-object,proto-from-ctor-realm} tests

This revealed a bug in the TypedArray(typedArray) constructor when the arg is backed by a SharedArrayBuffer.

Also install the species getter and add a test, since it's not tested in
test262 presently.

BUG=v8:5983,v8:5984
R=adamk@chromium.org

Review-Url: https://codereview.chromium.org/2798403004
Cr-Commit-Position: refs/heads/master@{#44500}

src/bootstrapper.cc

@@ -3901,7 +3901,9 @@ void Genesis::InitializeGlobal_harmony_sharedarraybuffer() {
                          Builtins::kSharedArrayBufferPrototypeGetByteLength,
                          BuiltinFunctionId::kSharedArrayBufferByteLength,
                          Builtins::kSharedArrayBufferPrototypeSlice);
-  native_context()->set_shared_array_buffer_fun(*shared_array_buffer_fun);
+  InstallWithIntrinsicDefaultProto(isolate, shared_array_buffer_fun,
+                                   Context::SHARED_ARRAY_BUFFER_FUN_INDEX);
+  InstallSpeciesGetter(shared_array_buffer_fun);
 
   Handle<String> name = factory->InternalizeUtf8String("Atomics");
   Handle<JSFunction> cons = factory->NewFunction(name);

src/js/typedarray.js

@@ -147,7 +147,12 @@ function NAMEConstructByTypedArray(obj, typedArray) {
   var byteLength = %_ArrayBufferViewGetByteLength(typedArray);
   var newByteLength = length * ELEMENT_SIZE;
   %typed_array_construct_by_array_like(obj, typedArray, length, ELEMENT_SIZE);
-  var bufferConstructor = SpeciesConstructor(srcData, GlobalArrayBuffer);
+  // The spec requires that constructing a typed array using a SAB-backed typed
+  // array use the ArrayBuffer constructor, not the species constructor. See
+  // https://tc39.github.io/ecma262/#sec-typedarray-typedarray.
+  var bufferConstructor = IS_SHAREDARRAYBUFFER(srcData)
+                            ? GlobalArrayBuffer
+                            : SpeciesConstructor(srcData, GlobalArrayBuffer);
   var prototype = bufferConstructor.prototype;
   // TODO(littledan): Use the right prototype based on bufferConstructor's realm
   if (IS_RECEIVER(prototype) && prototype !== GlobalArrayBufferPrototype) {

test/mjsunit/harmony/sharedarraybuffer.js

@@ -583,3 +583,13 @@ desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype,
 var a = new ArrayBuffer(10);
 Object.defineProperty(a, 'byteLength', desc);
 assertThrows(function() {a.byteLength}, TypeError);
+
+// test SharedArrayBuffer species getter
+assertSame(SharedArrayBuffer[Symbol.species], SharedArrayBuffer);
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer, Symbol.species);
+assertEquals("function", typeof desc.get);
+assertEquals("get [Symbol.species]", desc.get.name);
+assertEquals(0, desc.get.length);
+assertEquals("undefined", typeof desc.set);
+assertTrue(desc.configurable);
+assertFalse(desc.enumerable);

test/mjsunit/mjsunit.status

@@ -358,6 +358,10 @@
   'big-object-literal': [SKIP],
   'regress/regress-crbug-178790': [SKIP],
 
+  # https://bugs.chromium.org/p/v8/issues/detail?id=4639
+  # The failed allocation causes an asan/msan/tsan error
+  'es6/typedarray-construct-offset-not-smi': [SKIP],
+
   # Exception thrown during bootstrapping on ASAN builds, see issue 4236.
   'regress/regress-1132': [SKIP],
 }],  # 'asan == True'

test/test262/test262.status

@@ -538,12 +538,6 @@
   'built-ins/Atomics/wake/good-views': ['--harmony-sharedarraybuffer', FAIL],
   'built-ins/Atomics/xor/good-views': ['--harmony-sharedarraybuffer', FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=5983
-  'built-ins/SharedArrayBuffer/newtarget-prototype-is-not-object': [FAIL],
-
-  # https://bugs.chromium.org/p/v8/issues/detail?id=5984
-  'built-ins/SharedArrayBuffer/proto-from-ctor-realm': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=6045
   'intl402/NumberFormat/prototype/format/11.3.2_TRF': [FAIL],
   'intl402/NumberFormat/prototype/format/11.3.2_TRP': [FAIL],