[typedarrays] check byte offset for fast typedarray sort

BUG=v8:5953

Review-Url: https://codereview.chromium.org/2733393002
Cr-Commit-Position: refs/heads/master@{#43666}

src/runtime/runtime-typedarray.cc

@@ -375,17 +375,18 @@ RUNTIME_FUNCTION(Runtime_TypedArraySortFast) {
   size_t length = array->length_value();
   if (length <= 1) return *array;
 
+  Handle<FixedTypedArrayBase> elements(
+      FixedTypedArrayBase::cast(array->elements()));
   switch (array->type()) {
-#define TYPED_ARRAY_SORT(Type, type, TYPE, ctype, size)                    \
-  case kExternal##Type##Array: {                                           \
-    ctype* backing_store =                                                 \
-        static_cast<ctype*>(array->GetBuffer()->backing_store());          \
-    if (kExternal##Type##Array == kExternalFloat64Array ||                 \
-        kExternal##Type##Array == kExternalFloat32Array)                   \
-      std::sort(backing_store, backing_store + length, CompareNum<ctype>); \
-    else                                                                   \
-      std::sort(backing_store, backing_store + length);                    \
-    break;                                                                 \
+#define TYPED_ARRAY_SORT(Type, type, TYPE, ctype, size)     \
+  case kExternal##Type##Array: {                            \
+    ctype* data = static_cast<ctype*>(elements->DataPtr()); \
+    if (kExternal##Type##Array == kExternalFloat64Array ||  \
+        kExternal##Type##Array == kExternalFloat32Array)    \
+      std::sort(data, data + length, CompareNum<ctype>);    \
+    else                                                    \
+      std::sort(data, data + length);                       \
+    break;                                                  \
   }
 
     TYPED_ARRAYS(TYPED_ARRAY_SORT)

test/mjsunit/es6/typedarray-sort.js

@@ -52,4 +52,12 @@ for (var constructor of typedArrayConstructors) {
   assertEquals(a.length, 1);
   // Method doesn't work on other objects
   assertThrows(function() { a.sort.call([]); }, TypeError);
+
+  // Do not touch elements out of byte offset
+  var buf = new ArrayBuffer(constructor.BYTES_PER_ELEMENT * 3);
+  var a = new constructor(buf, constructor.BYTES_PER_ELEMENT);
+  var b = new constructor(buf);
+  b[0] = 3; b[1] = 2; b[2] = 1;
+  a.sort();
+  assertArrayLikeEquals(a, [1, 2], constructor);
 }