[builtins] Fix TypedArray slice for species constructor.

Bug: chromium:725865
Change-Id: I94006d45aefb969fb0cf98ec475c30c14b3837fa
Reviewed-on: https://chromium-review.googlesource.com/517488Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45567}

src/elements.cc

@@ -3103,7 +3103,7 @@ class TypedElementsAccessor
     ElementsAccessor* result_accessor = result_array->GetElementsAccessor();
     for (uint32_t i = start; i < end; i++) {
       Handle<Object> elem = AccessorClass::GetImpl(isolate, *from, i);
-      result_accessor->Set(result_array, i, *elem);
+      result_accessor->Set(result_array, i - start, *elem);
     }
     return result_array;
   }

src/objects-inl.h

@@ -3950,7 +3950,7 @@ typename Traits::ElementType FixedTypedArray<Traits>::get_scalar(int index) {
 
 template <class Traits>
 void FixedTypedArray<Traits>::set(int index, ElementType value) {
-  DCHECK((index >= 0) && (index < this->length()));
+  CHECK((index >= 0) && (index < this->length()));
   ElementType* ptr = reinterpret_cast<ElementType*>(DataPtr());
   ptr[index] = value;
 }

test/mjsunit/es6/typedarray-slice.js

@@ -95,9 +95,18 @@ for (var constructor of typedArrayConstructors) {
 for (var constructor1 of typedArrayConstructors) {
   for (var constructor2 of typedArrayConstructors) {
     testCustomSubclass(constructor1, constructor2);
+    testSpeciesConstructor(constructor1, constructor2);
   }
 }
 
+function testSpeciesConstructor(cons1, cons2) {
+  var ta = new cons1([1, 2, 3, 4, 5, 6]);
+  ta.constructor = {
+    [Symbol.species]: cons2
+  };
+  assertArrayEquals([4, 5, 6], ta.slice(3));
+}
+
 function testCustomSubclass(superClass, speciesClass) {
   // Simple subclass that has another TypedArray as species
   class CustomTypedArray extends superClass {