Only evaluate length once in %TypedArray%.prototype.set

The ES6 spec for this function declares that ToLength
should only be called once. We were evaluating it multiple
times, so if length was an object with a valueOf method,
we could see effects take place multiple times.

R=littledan@chromium.org
LOG=N
BUG=v8:4218

Review URL: https://codereview.chromium.org/1237583005

Cr-Commit-Position: refs/heads/master@{#30240}

src/typedarray.js

@@ -330,6 +330,7 @@ function TypedArraySet(obj, offset) {
         }
         return;
       }
+      l = $toLength(l);
       if (intOffset + l > this.length) {
         throw MakeRangeError(kTypedArraySetSourceTooLarge);
       }

test/mjsunit/es6/typedarray-set-length.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var typedArrayConstructors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Uint8ClampedArray,
+  Float32Array,
+  Float64Array
+];
+
+var lengthCalled = false;
+function lengthValue() {
+  assertFalse(lengthCalled);
+  lengthCalled = true;
+  return 5;
+}
+
+// ToLength should convert these to usable lengths.
+var goodNonIntegerLengths = [
+  function() { return 4.6; },
+  function() { return -5; },
+  function() { return NaN; },
+  function() { return "5"; },
+  function() { return "abc"; },
+  function() { return true; },
+  function() { return null; },
+  function() { return undefined; }
+];
+
+// This will fail if you use ToLength on it.
+function badNonIntegerLength() {
+  return Symbol("5");
+}
+
+for (var constructor of typedArrayConstructors) {
+  lengthCalled = false;
+  var a = new constructor(10);
+  a.set({length: {valueOf: lengthValue}});
+  assertTrue(lengthCalled);
+
+  for (var lengthFun of goodNonIntegerLengths) {
+    a.set({length: {valueOf: lengthFun}});
+  }
+
+  assertThrows(function() {
+    a.set({length: {valueOf: badNonIntegerLength}});
+  }, TypeError);
+}