[rab/gsab] TypedArray.p.slice fix: Destination can be resizable

Bug: v8:11111,chromium:1359991
Fixed: chromium:1359991
Change-Id: Ie150040d2831559eebb646772d9b2c494aadda98
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3874930Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83012}

src/objects/elements.cc

@@ -3657,7 +3657,7 @@ class TypedElementsAccessor
     DCHECK_LE(start, end);
     DCHECK_LE(end, source.GetLength());
     size_t count = end - start;
-    DCHECK_LE(count, destination.length());
+    DCHECK_LE(count, destination.GetLength());
     ElementType* dest_data = static_cast<ElementType*>(destination.DataPtr());
     auto is_shared =
         source.buffer().is_shared() || destination.buffer().is_shared()

test/mjsunit/regress-crbug-1359991.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-rab-gsab
+
+"use strict";
+
+const rab = new ArrayBuffer(1744, {"maxByteLength": 4000});
+let callSlice = true;
+class MyFloat64Array extends Float64Array {
+  constructor() {
+    super(rab);
+    if (callSlice) {
+      callSlice = false;  // Prevent recursion
+      super.slice()
+    }
+  }
+};
+new MyFloat64Array();