[test] Fix TypedArray::sort for multi-mapped mock allocator

Turns out std::sort() gets angry when various ranges of an array
alias each other in memory. We wouldn't like it when it's angry.

Fixed: chromium:1209152
Change-Id: Ic927b46c59d10f7d3856768628c773b344005979
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897098
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74598}

src/runtime/runtime-typedarray.cc

@@ -94,6 +94,14 @@ RUNTIME_FUNCTION(Runtime_TypedArraySortFast) {
   CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, array, 0);
   DCHECK(!array->WasDetached());
 
+#if V8_OS_LINUX
+  if (FLAG_multi_mapped_mock_allocator) {
+    // Sorting is meaningless with the mock allocator, and std::sort
+    // might crash (because aliasing elements violate its assumptions).
+    return *array;
+  }
+#endif
+
   size_t length = array->length();
   DCHECK_LT(1, length);
 

test/mjsunit/regress/regress-crbug-1209152.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --multi-mapped-mock-allocator
+
+let size = 8 * 1024 * 1024;
+let initialized = 2 * 1024 * 1008;
+let array = new Uint8Array(size);
+for (let i = 0; i < initialized; i++) {
+  array[i] = 42;
+}
+array.sort();