[objects] Fix TestElementsIntegrityLevel for typed arrays

Typed arrays with elements cannot be frozen, but this function
previously would have falsely reported that they are after
an `Object.freeze()` call. Since the latter bails out when
the object is already frozen, the effect was that when calling
`Object.freeze()` on a typed array more than once, the first call
would throw and subsequent ones would not.

Change-Id: I75e59f51ebb94797cdf39bac4ec4c25c547e70a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1552781
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60652}

src/objects/js-objects.cc

@@ -3666,6 +3666,8 @@ bool TestElementsIntegrityLevel(JSObject object, PropertyAttributes level) {
         level);
   }
   if (IsFixedTypedArrayElementsKind(kind)) {
+    if (level == FROZEN && JSArrayBufferView::cast(object)->byte_length() > 0)
+      return false;  // TypedArrays with elements can't be frozen.
     return TestPropertiesIntegrityLevel(object, level);
   }
 

test/mjsunit/object-freeze.js

@@ -505,3 +505,15 @@ assertTrue(%HasPackedElements(arr2));
 Object.preventExtensions(arr2);
 Object.freeze(arr2);
 testPackedFrozenArray2(arr2);
+
+// Verify that repeatedly attemping to freeze a typed array fails
+var typedArray = new Uint8Array(10);
+assertThrows(() => { Object.freeze(typedArray); }, TypeError);
+assertFalse(Object.isFrozen(typedArray));
+assertThrows(() => { Object.freeze(typedArray); }, TypeError);
+assertFalse(Object.isFrozen(typedArray));
+
+// Verify that freezing an empty typed array works
+var typedArray = new Uint8Array(0);
+Object.freeze(typedArray);
+assertTrue(Object.isFrozen(typedArray));