[objects] Correctly Object.isSeal for TypedArray

Add a special handle of TypedArray elements in TestElementsIntegrityLevel

Bug: v8:8082
Change-Id: I60be644801618b576b0b8b1883ac67bf0040c849
Reviewed-on: https://chromium-review.googlesource.com/c/1412133Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58874}

AUTHORS

@@ -165,6 +165,7 @@ Victor Costan <costan@gmail.com>
 Vlad Burlik <vladbph@gmail.com>
 Vladimir Krivosheev <develar@gmail.com>
 Vladimir Shutoff <vovan@shutoff.ru>
+Wenlu Wang <kingwenlu@gmail.com>
 Wiktor Garbacz <wiktor.garbacz@gmail.com>
 Xiaoyin Liu <xiaoyin.l@outlook.com>
 Yannic Bonenberger <contact@yannic-bonenberger.com>

src/objects.cc

@@ -8441,6 +8441,9 @@ bool TestElementsIntegrityLevel(JSObject object, PropertyAttributes level) {
         NumberDictionary::cast(object->elements()), object->GetReadOnlyRoots(),
         level);
   }
+  if (IsFixedTypedArrayElementsKind(kind)) {
+    return TestPropertiesIntegrityLevel(object, level);
+  }
 
   ElementsAccessor* accessor = ElementsAccessor::ForKind(kind);
   // Only DICTIONARY_ELEMENTS and SLOW_SLOPPY_ARGUMENTS_ELEMENTS have

test/mjsunit/object-seal.js

@@ -389,3 +389,7 @@ Object.seal(Sealed);
 assertDoesNotThrow(function() { return new Sealed(); });
 Sealed.prototype.prototypeExists = true;
 assertTrue((new Sealed()).prototypeExists);
+
+obj = new Int32Array(10)
+Object.seal(obj);
+assertTrue(Object.isSealed(obj));