Add %TypedArray% to proto chain

test/mjsunit/regress/regress-typedarray-length.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
 var a = new Int32Array(100);
 a.__proto__ = null;
 
 function get(a) {
@@ skipping 53 matching lines @@
     return a.length;
   }
 
   assertEquals(undefined, get(a));
   assertEquals(undefined, get(a));
   assertEquals(undefined, get(a));
   %OptimizeFunctionOnNextCall(get);
   assertEquals(undefined, get(a));
 })();
 
 // Ensure we cannot delete length, byteOffset, byteLength.

[arv (Not doing code reviews), 2015/06/15 16:23:12]

I think this is invalid. Maybe justs file a bug and we can get back to this.

[Dan Ehrenberg, 2015/06/15 23:28:35]

Fixed it.

-assertTrue(Int32Array.prototype.hasOwnProperty("length"));
-assertTrue(Int32Array.prototype.hasOwnProperty("byteOffset"));
-assertTrue(Int32Array.prototype.hasOwnProperty("byteLength"));
-assertFalse(delete Int32Array.prototype.length);
-assertFalse(delete Int32Array.prototype.byteOffset);
-assertFalse(delete Int32Array.prototype.byteLength);
+assertTrue(Int32Array.prototype.__proto__.hasOwnProperty("length"));
+assertTrue(Int32Array.prototype.__proto__.hasOwnProperty("byteOffset"));
+assertTrue(Int32Array.prototype.__proto__.hasOwnProperty("byteLength"));
+assertFalse(delete Int32Array.prototype.__proto__.length);
+assertFalse(delete Int32Array.prototype.__proto__.byteOffset);
+assertFalse(delete Int32Array.prototype.__proto__.byteLength);
 
 a = new Int32Array(100);
 
 get = function(a) {
   return a.length;
 }
 
 assertEquals(100, get(a));
 assertEquals(100, get(a));
 assertEquals(100, get(a));
@@ skipping 12 matching lines @@
 
 get = function(a) {
   return a.byteOffset;
 }
 
 assertEquals(0, get(a));
 assertEquals(0, get(a));
 assertEquals(0, get(a));
 %OptimizeFunctionOnNextCall(get);
 assertEquals(0, get(a));