Don't use length property when bounds checking atomics functions

src/harmony-atomics.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 15 matching lines @@
   if (!%_IsSharedIntegerTypedArray(ia)) {
     throw MakeTypeError(kNotIntegerSharedTypedArray, ia);
   }
 }
 
 //-------------------------------------------------------------------
 
 function AtomicsCompareExchangeJS(sta, index, oldValue, newValue) {
   CheckSharedTypedArray(sta);
   index = $toInteger(index);
-  if (index < 0 || index >= sta.length) {
+  if (index < 0 || index >= %_TypedArrayGetLength(sta)) {
     return UNDEFINED;
   }
   return %_AtomicsCompareExchange(sta, index, oldValue, newValue);
 }
 
 function AtomicsLoadJS(sta, index) {
   CheckSharedTypedArray(sta);
   index = $toInteger(index);
-  if (index < 0 || index >= sta.length) {
+  if (index < 0 || index >= %_TypedArrayGetLength(sta)) {
     return UNDEFINED;
   }
   return %_AtomicsLoad(sta, index);
 }
 
 function AtomicsStoreJS(sta, index, value) {
   CheckSharedTypedArray(sta);
   index = $toInteger(index);
-  if (index < 0 || index >= sta.length) {
+  if (index < 0 || index >= %_TypedArrayGetLength(sta)) {
     return UNDEFINED;
   }
   return %_AtomicsStore(sta, index, value);
 }
 
 function AtomicsAddJS(ia, index, value) {
   CheckSharedIntegerTypedArray(ia);
   index = $toInteger(index);
-  if (index < 0 || index >= ia.length) {
+  if (index < 0 || index >= %_TypedArrayGetLength(ia)) {
     return UNDEFINED;
   }
   return %_AtomicsAdd(ia, index, value);
 }
 
 function AtomicsSubJS(ia, index, value) {
   CheckSharedIntegerTypedArray(ia);
   index = $toInteger(index);
-  if (index < 0 || index >= ia.length) {
+  if (index < 0 || index >= %_TypedArrayGetLength(ia)) {
     return UNDEFINED;
   }
   return %_AtomicsSub(ia, index, value);
 }
 
 function AtomicsAndJS(ia, index, value) {
   CheckSharedIntegerTypedArray(ia);
   index = $toInteger(index);
-  if (index < 0 || index >= ia.length) {
+  if (index < 0 || index >= %_TypedArrayGetLength(ia)) {
     return UNDEFINED;
   }
   return %_AtomicsAnd(ia, index, value);
 }
 
 function AtomicsOrJS(ia, index, value) {
   CheckSharedIntegerTypedArray(ia);
   index = $toInteger(index);
-  if (index < 0 || index >= ia.length) {
+  if (index < 0 || index >= %_TypedArrayGetLength(ia)) {
     return UNDEFINED;
   }
   return %_AtomicsOr(ia, index, value);
 }
 
 function AtomicsXorJS(ia, index, value) {
   CheckSharedIntegerTypedArray(ia);
   index = $toInteger(index);
-  if (index < 0 || index >= ia.length) {
+  if (index < 0 || index >= %_TypedArrayGetLength(ia)) {
     return UNDEFINED;
   }
   return %_AtomicsXor(ia, index, value);
 }
 
 function AtomicsExchangeJS(ia, index, value) {
   CheckSharedIntegerTypedArray(ia);
   index = $toInteger(index);
-  if (index < 0 || index >= ia.length) {
+  if (index < 0 || index >= %_TypedArrayGetLength(ia)) {
     return UNDEFINED;
   }
   return %_AtomicsExchange(ia, index, value);
 }
 
 function AtomicsIsLockFreeJS(size) {
   return %_AtomicsIsLockFree(size);
 }
 
 // -------------------------------------------------------------------
@@ skipping 15 matching lines @@
   "add", AtomicsAddJS,
   "sub", AtomicsSubJS,
   "and", AtomicsAndJS,
   "or", AtomicsOrJS,
   "xor", AtomicsXorJS,
   "exchange", AtomicsExchangeJS,
   "isLockFree", AtomicsIsLockFreeJS,
 ]);
 
 })