[typedarray] Properly convert hole to undefined in TypedArray.from

It used to call the old IterableToList, which had the wrong
semantics for holes.

Bug: v8:8133
Change-Id: Idd5acd55a155bc43df7552135a44151bb2db38e9
Reviewed-on: https://chromium-review.googlesource.com/1213204Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55745}

src/builtins/builtins-typed-array-gen.cc

@@ -1670,9 +1670,8 @@ TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
     // 7. If usingIterator is not undefined, then
     //  a. Let values be ? IterableToList(source, usingIterator).
     //  b. Let len be the number of elements in values.
-    TNode<JSArray> values =
-        CAST(CallBuiltin(Builtins::kIterableToListMayPreserveHoles, context,
-                         source, iterator_fn));
+    TNode<JSArray> values = CAST(
+        CallBuiltin(Builtins::kIterableToList, context, source, iterator_fn));
 
     // This is not a spec'd limit, so it doesn't particularly matter when we
     // throw the range error for typed array length > MaxSmi.

test/mjsunit/regress/regress-8133-1.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const arr = [1, , 3];
+
+function mapper(x) {
+  Array.prototype[1] = 2;
+  return x + 1;
+}
+
+// This iterates over arr using the iterator protocol, which turns the hole into
+// undefined.  The mapper function then gets called in a separate iteration over
+// the acquired elements, where it increments undefined, which produces NaN and
+// gets converted to 0.
+assertArrayEquals([2, 0, 4], Uint16Array.from(arr, mapper));

test/mjsunit/regress/regress-8133-2.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const arr = [1, , 3];
+
+function mapper(x) {
+  Array.prototype[1] = 2;
+  return x + 1;
+}
+
+// We force a direct iteration (using the array length, not the iterator
+// protocol). The mapper function gets called during this iteration, not in a
+// separate one. Hence when index 1 is read, 2 is retrieved from the prototype
+// and incremented to 3.
+Array.prototype[Symbol.iterator] = undefined;
+assertArrayEquals([2, 3, 4], Uint16Array.from(arr, mapper));