math.js: Use %_TypedArrayGetLength to get length

https://codereview.chromium.org/2001393004 makes TypedArray
length property writable, which means we shouldn't depend on it.
Instead, use %_TypedArrayGetLength% to get length.

Attached regression test.

BUG=chromium:615776

Review-Url: https://codereview.chromium.org/2020203006
Cr-Commit-Position: refs/heads/master@{#36655}

src/js/math.js

@@ -62,15 +62,19 @@ function MathRandom() {
   // first two elements are reserved for the PRNG state.
   if (nextRandomIndex <= kRandomNumberStart) {
     randomNumbers = %GenerateRandomNumbers(randomNumbers);
+    if (%_IsTypedArray(randomNumbers)) {
+      nextRandomIndex = %_TypedArrayGetLength(randomNumbers);
+    } else {
       nextRandomIndex = randomNumbers.length;
     }
+  }
   return randomNumbers[--nextRandomIndex];
 }
 
 function MathRandomRaw() {
   if (nextRandomIndex <= kRandomNumberStart) {
     randomNumbers = %GenerateRandomNumbers(randomNumbers);
-    nextRandomIndex = randomNumbers.length;
+    nextRandomIndex = %_TypedArrayGetLength(randomNumbers);
   }
   return %_DoubleLo(randomNumbers[--nextRandomIndex]) & 0x3FFFFFFF;
 }

test/mjsunit/regress/regress-615776.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(Int32Array.prototype.__proto__, 'length', {
+  get: function() { throw new Error('Custom length property'); }
+});
+
+var a = Math.random();
+
+// This tests MathRandomRaw.
+var v0 = new Set();
+var v1 = new Object();
+v0.add(v1);