[rab/gsab] Fix accessing raw byte length

Bug: v8:11111,chromium:1347721
Change-Id: Idff4256f6720841ca4dee8f691babe7245277046
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3782812Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81995}

src/objects/elements.cc

@@ -3735,8 +3735,8 @@ class TypedElementsAccessor
 
     uint8_t* source_data = static_cast<uint8_t*>(source.DataPtr());
     uint8_t* dest_data = static_cast<uint8_t*>(destination.DataPtr());
-    size_t source_byte_length = source.byte_length();
-    size_t dest_byte_length = destination.byte_length();
+    size_t source_byte_length = source.GetByteLength();
+    size_t dest_byte_length = destination.GetByteLength();
 
     bool source_shared = source.buffer().is_shared();
     bool destination_shared = destination.buffer().is_shared();

test/mjsunit/regress/regress-crbug-1347721.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-rab-gsab
+
+for (let i = 0; i < 10000; i++) {
+  const rab = new ArrayBuffer(1632, {"maxByteLength": 9943683});
+  const ta1 = new Uint32Array(rab);
+  const ta2 = new Float32Array(rab);
+  rab.resize(2004);
+  ta1["set"](ta2);
+}