[builtins] Fix TypedArray.Set for string inputs.

String inputs would end up in the fast-path, crashing because it
expected an array type. Add the fast path explicitly when the source is
a TypedArray, and let everything else fall back to the generic JS
implementation.

Bug: chromium:715971
Change-Id: Ieec28e93279047d403e00ed2676dc1eda193c033
Reviewed-on: https://chromium-review.googlesource.com/493226
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45034}

src/js/typedarray.js

@@ -255,7 +255,9 @@ function TypedArraySetFromArrayLike(target, source, sourceLength, offset) {
     }
   }
   else {
-    %TypedArrayCopyElements(target, source, sourceLength);
+    for (var i = 0; i < sourceLength; i++) {
+      target[i] = source[i];
+    }
   }
 }
 
@@ -319,6 +321,7 @@ function TypedArraySet(obj, offset) {
   if (intOffset > %_MaxSmi()) {
     throw %make_range_error(kTypedArraySetSourceTooLarge);
   }
+
   switch (%TypedArraySetFastCases(this, obj, intOffset)) {
     // These numbers should be synchronized with runtime.cc.
     case 0: // TYPED_ARRAY_SET_TYPED_ARRAY_SAME_TYPE
@@ -327,8 +330,12 @@ function TypedArraySet(obj, offset) {
       TypedArraySetFromOverlappingTypedArray(this, obj, intOffset);
       return;
     case 2: // TYPED_ARRAY_SET_TYPED_ARRAY_NONOVERLAPPING
-      TypedArraySetFromArrayLike(this,
-          obj, %_TypedArrayGetLength(obj), intOffset);
+      if (intOffset === 0) {
+        %TypedArrayCopyElements(this, obj, %_TypedArrayGetLength(obj));
+      } else {
+        TypedArraySetFromArrayLike(
+            this, obj, %_TypedArrayGetLength(obj), intOffset);
+      }
       return;
     case 3: // TYPED_ARRAY_SET_NON_TYPED_ARRAY
       var l = obj.length;

test/mjsunit/es6/typedarray.js

@@ -496,6 +496,16 @@ function TestTypedArraySet() {
     }
   }
 
+  a = new Uint32Array();
+  a.set('');
+  assertEquals(0, a.length);
+
+  assertThrows(() => a.set('abc'), RangeError);
+
+  a = new Uint8Array(3);
+  a.set('123');
+  assertArrayEquals([1, 2, 3], a);
+
   var a11 = new Int16Array([1, 2, 3, 4, 0, -1])
   var a12 = new Uint16Array(15)
   a12.set(a11, 3)