Reland of [typedarrays] remove invalid optimization in NAMEConstructor()...

Reland of [typedarrays] remove invalid optimization in NAMEConstructor() (patchset #1 id:1 of https://codereview.chromium.org/2548583003/ )

Reason for revert:
The bot was not affected by the revert. Speculation was wrong.

Original issue's description:
> Revert of [typedarrays] remove invalid optimization in NAMEConstructor() (patchset #1 id:1 of https://codereview.chromium.org/2544503002/ )
>
> Reason for revert:
> Speculative revert for causing timeouts on Win Debug gpu fyi bot
>
> Nothing else looks even remotely relevant in the list of changes.
> Will reland if this doesn't fix the issues.
>
> BUG=670396
>
> Original issue's description:
> > [typedarrays] remove invalid optimization in NAMEConstructor()
> >
> > Before, we were treating objects with the builtin ArrayValues iterator
> > method as array-like, where the iterator would iterate through to the
> > full length of the object.
> >
> > This optimization was not sound, because it does not ensure that the
> > next method hasn't been modified. Even if it hasn't been modified,
> > it's entirely possible to be modified during iteration. Thus, this
> > optimization has been removed due to its observability.
> >
> > BUG=v8:5699
> > R=littledan@chromium.org, cbruni@chromium.org
> >
> > Committed: https://crrev.com/77df8c67d9609ada3b7d79e8e6d33f198bbad5a1
> > Cr-Commit-Position: refs/heads/master@{#41394}
>
> TBR=cbruni@chromium.org,littledan@chromium.org,caitp@igalia.com
> # Not skipping CQ checks because original CL landed more than 1 days ago.
> BUG=v8:5699
>
> Committed: https://crrev.com/0ea4a542202d501c4e550474e89512532571f3a0
> Cr-Commit-Position: refs/heads/master@{#41461}

TBR=cbruni@chromium.org,littledan@chromium.org,caitp@igalia.com,enne@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=670396

Review-Url: https://codereview.chromium.org/2553873002
Cr-Commit-Position: refs/heads/master@{#41504}

src/js/typedarray.js

@@ -260,7 +260,7 @@ function NAMEConstructor(arg1, arg2, arg3) {
       NAMEConstructByTypedArray(this, arg1);
     } else if (IS_RECEIVER(arg1)) {
       var iteratorFn = arg1[iteratorSymbol];
-      if (IS_UNDEFINED(iteratorFn) || iteratorFn === ArrayValues) {
+      if (IS_UNDEFINED(iteratorFn)) {
         NAMEConstructByArrayLike(this, arg1, arg1.length);
       } else {
         NAMEConstructByIterable(this, arg1, iteratorFn);

test/mjsunit/es6/typedarray.js

@@ -334,6 +334,31 @@ function TestTypedArray(constr, elementSize, typicalElement) {
   assertEquals(0, genArr[0]);
   assertEquals(9, genArr[9]);
   assertEquals(1, iteratorReadCount);
+
+  // Modified %ArrayIteratorPrototype%.next() method is honoured (v8:5699)
+  const ArrayIteratorPrototype = Object.getPrototypeOf([][Symbol.iterator]());
+  const ArrayIteratorPrototypeNext = ArrayIteratorPrototype.next;
+  ArrayIteratorPrototype.next = function() {
+    return { done: true };
+  };
+  genArr = new constr([1, 2, 3]);
+  assertEquals(0, genArr.length);
+  ArrayIteratorPrototype.next = ArrayIteratorPrototypeNext;
+
+  // Modified %ArrayIteratorPrototype%.next() during iteration is honoured as
+  // well.
+  genArr = new constr(Object.defineProperty([1, , 3], 1, {
+    get() {
+      ArrayIteratorPrototype.next = function() {
+        return { done: true };
+      }
+      return 2;
+    }
+  }));
+  assertEquals(2, genArr.length);
+  assertEquals(1, genArr[0]);
+  assertEquals(2, genArr[1]);
+  ArrayIteratorPrototype.next = ArrayIteratorPrototypeNext;
 }
 
 TestTypedArray(Uint8Array, 1, 0xFF);