Add %TypedArray% to proto chain

test/mjsunit/regress/regress-typedarray-length.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
 var a = new Int32Array(100);
 a.__proto__ = null;
 
 function get(a) {
@@ skipping 53 matching lines @@
     return a.length;
   }
 
   assertEquals(undefined, get(a));
   assertEquals(undefined, get(a));
   assertEquals(undefined, get(a));
   %OptimizeFunctionOnNextCall(get);
   assertEquals(undefined, get(a));
 })();
 
-// Ensure we cannot delete length, byteOffset, byteLength.
-assertTrue(Int32Array.prototype.hasOwnProperty("length"));
-assertTrue(Int32Array.prototype.hasOwnProperty("byteOffset"));
-assertTrue(Int32Array.prototype.hasOwnProperty("byteLength"));
-assertFalse(delete Int32Array.prototype.length);
-assertFalse(delete Int32Array.prototype.byteOffset);
-assertFalse(delete Int32Array.prototype.byteLength);
-
 a = new Int32Array(100);
 
 get = function(a) {
   return a.length;
 }
 
 assertEquals(100, get(a));
 assertEquals(100, get(a));
 assertEquals(100, get(a));
 %OptimizeFunctionOnNextCall(get);
@@ skipping 11 matching lines @@
 
 get = function(a) {
   return a.byteOffset;
 }
 
 assertEquals(0, get(a));
 assertEquals(0, get(a));
 assertEquals(0, get(a));
 %OptimizeFunctionOnNextCall(get);
 assertEquals(0, get(a));
+
+// Ensure we can delete length, byteOffset, byteLength.
+for (var name of ['length', 'byteOffset', 'byteLength', 'buffer']) {
+  var property = Object.getOwnPropertyDescriptor(
+                     Int32Array.prototype.__proto__, name);
+  assertEquals("object", typeof property);
+  assertEquals(true, property.configurable);
+  assertEquals(false, property.enumerable);
+  assertEquals("function", typeof property.get);
+}