Use internal byteOffset in TypedArray.prototype.set

Since byteOffset is configurable, we need to access byteOffset by
%_ArrayBufferViewGetByteOffset, instead of accessing .byteOffset
property.

BUG=v8:6120

Review-Url: https://codereview.chromium.org/2761673003
Cr-Commit-Position: refs/heads/master@{#44347}

src/js/typedarray.js

@@ -255,10 +255,11 @@ function TypedArraySetFromOverlappingTypedArray(target, source, offset) {
   // Copy left part.
   function CopyLeftPart() {
     // First un-mutated byte after the next write
-    var targetPtr = target.byteOffset + (offset + 1) * targetElementSize;
+    var targetPtr = %_ArrayBufferViewGetByteOffset(target) +
+                    (offset + 1) * targetElementSize;
     // Next read at sourcePtr. We do not care for memory changing before
     // sourcePtr - we have already copied it.
-    var sourcePtr = source.byteOffset;
+    var sourcePtr = %_ArrayBufferViewGetByteOffset(source);
     for (var leftIndex = 0;
          leftIndex < sourceLength && targetPtr <= sourcePtr;
          leftIndex++) {
@@ -273,12 +274,12 @@ function TypedArraySetFromOverlappingTypedArray(target, source, offset) {
   // Copy right part;
   function CopyRightPart() {
     // First unmutated byte before the next write
-    var targetPtr =
-      target.byteOffset + (offset + sourceLength - 1) * targetElementSize;
+    var targetPtr = %_ArrayBufferViewGetByteOffset(target) +
+                    (offset + sourceLength - 1) * targetElementSize;
     // Next read before sourcePtr. We do not care for memory changing after
     // sourcePtr - we have already copied it.
-    var sourcePtr =
-      source.byteOffset + sourceLength * sourceElementSize;
+    var sourcePtr = %_ArrayBufferViewGetByteOffset(source) +
+                    sourceLength * sourceElementSize;
     for(var rightIndex = sourceLength - 1;
         rightIndex >= leftIndex && targetPtr >= sourcePtr;
         rightIndex--) {

test/test262/local-tests/test/built-ins/TypedArray/prototype/set/typedarray-arg-src-byteoffset-internal.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.set-typedarray-offset
+description: >
+  Uses typedArray's internal [[ByteOffset]]
+info: >
+  22.2.3.23.2 %TypedArray%.prototype.set(typedArray [ , offset ] )
+  1. Assert: typedArray has a [[TypedArrayName]] internal slot. If it does not,
+  the definition in 22.2.3.23.1 applies.
+  ...
+  21. Let srcByteOffset be typedArray.[[ByteOffset]].
+  ...
+includes: [testTypedArray.js]
+---*/
+
+var getCalls = 0;
+var desc = {
+  get: function getLen() {
+    getCalls++;
+    return 0;
+  }
+};
+
+Object.defineProperty(TypedArray.prototype, "byteOffset", desc);
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA(2);
+  var src = new TA([42, 43]);
+  var differentTA = TA === Uint8Array ? Int8Array : Uint8Array;
+  var src2 = new differentTA([42, 43]);
+  var src3 = new differentTA(sample.buffer, 0, 2);
+
+  Object.defineProperty(TA.prototype, "byteOffset", desc);
+  Object.defineProperty(src, "byteOffset", desc);
+  Object.defineProperty(src2, "byteOffset", desc);
+  Object.defineProperty(src3, "byteOffset", desc);
+
+  sample.set(src);
+  sample.set(src2);
+  sample.set(src3);
+
+  assert.sameValue(getCalls, 0, "ignores byteOffset properties");
+});

test/test262/local-tests/test/built-ins/TypedArray/prototype/set/typedarray-arg-target-byteoffset-internal.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.set-typedarray-offset
+description: >
+  Uses target's internal [[ArrayLength]]
+info: >
+  22.2.3.23.2 %TypedArray%.prototype.set(typedArray [ , offset ] )
+  1. Assert: typedArray has a [[TypedArrayName]] internal slot. If it does not,
+  the definition in 22.2.3.23.1 applies.
+  2. Let target be the this value.
+  ...
+  16. Let targetByteOffset be target.[[ByteOffset]].
+  ...
+includes: [testTypedArray.js]
+---*/
+
+var getCalls = 0;
+var desc = {
+  get: function() {
+    getCalls++;
+    return 0;
+  }
+};
+
+Object.defineProperty(TypedArray.prototype, "byteOffset", desc);
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA(2);
+  var src = new TA([42, 43]);
+  var differentTA = TA === Uint8Array ? Int8Array : Uint8Array;
+  var src2 = new differentTA([42, 43]);
+  var src3 = new differentTA(sample.buffer, 0, 2);
+
+  Object.defineProperty(TA.prototype, "byteOffset", desc);
+  Object.defineProperty(sample, "byteOffset", desc);
+
+  sample.set(src);
+  sample.set(src2);
+  sample.set(src3);
+
+  assert.sameValue(getCalls, 0, "ignores byteoffset properties");
+});