[runtime] Fix relaxed memmove in TypedArray.prototype.set

If either target or source are shared buffers, use relaxed memmove.

Bug: chromium:1353555
Change-Id: Ieaad826c610b0f2f808b4061947372d851f95978
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3862209Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82812}

src/builtins/typed-array-set.tq

@@ -274,7 +274,8 @@ TypedArrayPrototypeSetTypedArray(implicit context: Context, receiver: JSAny)(
     //                                  value, true, Unordered).
     //    iii. Set srcByteIndex to srcByteIndex + 1.
     //     iv. Set targetByteIndex to targetByteIndex + 1.
-    if (IsSharedArrayBuffer(target.buffer)) {
+    if (IsSharedArrayBuffer(target.buffer) ||
+        IsSharedArrayBuffer(source.buffer)) {
       // SABs need a relaxed memmove to preserve atomicity.
       CallCRelaxedMemmove(dstPtr, source.data_ptr, countBytes);
     } else {

test/mjsunit/regress/regress-1353555.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const worker = new Worker(`function onmessage(buffer) {
+  const shared2 = new Int32Array(buffer);
+  shared2.fill(1);
+}`, {
+  type: 'string'
+});
+
+const shared = new Int32Array(new SharedArrayBuffer(4));
+worker.postMessage(shared.buffer);
+
+while (Atomics.load(shared) == 0) {}
+(new Int32Array(1)).set(shared);