Implement in-heap backing store for typed arrays.

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index ba9da22aef8aef0663fc51578e7de6eb66762474..f7902464490e62cc33032f194a09a11121fd1c9c 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -5218,7 +5218,8 @@ Handle<Object> Runtime::SetObjectProperty(Isolate* isolate,
     }
 
     js_object->ValidateElements();
-    if (js_object->HasExternalArrayElements()) {
+    if (js_object->HasExternalArrayElements() ||
+        js_object->HasFixedTypedArrayElements()) {
       if (!value->IsNumber() && !value->IsUndefined()) {
         bool has_exception;
         Handle<Object> number =
@@ -10011,6 +10012,15 @@ static uint32_t EstimateElementCount(Handle<JSArray> array) {
     case EXTERNAL_FLOAT_ELEMENTS:
     case EXTERNAL_DOUBLE_ELEMENTS:
     case EXTERNAL_PIXEL_ELEMENTS:
+    case UINT8_ELEMENTS:
+    case INT8_ELEMENTS:
+    case UINT16_ELEMENTS:
+    case INT16_ELEMENTS:
+    case UINT32_ELEMENTS:
+    case INT32_ELEMENTS:
+    case FLOAT32_ELEMENTS:
+    case FLOAT64_ELEMENTS:
+    case UINT8_CLAMPED_ELEMENTS:
       // External arrays are always dense.
       return length;
   }