Implement in-heap backing store for typed arrays.

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index a1f04a270ecddb31bc5da7e8010f9de81a3b1459..8697a91ce5a4edfbc20e2c4447bba64d773eb0f0 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -5218,7 +5218,8 @@ Handle<Object> Runtime::SetObjectProperty(Isolate* isolate,
     }
 
     js_object->ValidateElements();
-    if (js_object->HasExternalArrayElements()) {
+    if (js_object->HasExternalArrayElements() ||
+        js_object->HasFixedTypedArrayElements()) {
       if (!value->IsNumber() && !value->IsUndefined()) {
         bool has_exception;
         Handle<Object> number =
@@ -10007,6 +10008,15 @@ static uint32_t EstimateElementCount(Handle<JSArray> array) {
     case EXTERNAL_FLOAT_ELEMENTS:
     case EXTERNAL_DOUBLE_ELEMENTS:
     case EXTERNAL_PIXEL_ELEMENTS:
+    case UINT8_ELEMENTS:
+    case INT8_ELEMENTS:
+    case UINT16_ELEMENTS:
+    case INT16_ELEMENTS:
+    case UINT32_ELEMENTS:
+    case INT32_ELEMENTS:
+    case FLOAT32_ELEMENTS:
+    case FLOAT64_ELEMENTS:
+    case UINT8_CLAMPED_ELEMENTS:
       // External arrays are always dense.
       return length;
   }