Only evaluate length once in %TypedArray%.prototype.set

src/typedarray.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 312 matching lines @@
       if (IS_UNDEFINED(l)) {
         if (IS_NUMBER(obj)) {
             // For number as a first argument, throw TypeError
             // instead of silently ignoring the call, so that
             // the user knows (s)he did something wrong.
             // (Consistent with Firefox and Blink/WebKit)
             throw MakeTypeError(kInvalidArgument);
         }
         return;
       }
+      l = $toLength(l);
       if (intOffset + l > this.length) {
         throw MakeRangeError(kTypedArraySetSourceTooLarge);
       }
       TypedArraySetFromArrayLike(this, obj, l, intOffset);
       return;
   }
 }
 
 function TypedArrayGetToStringTag() {
   if (!%_IsTypedArray(this)) return;
@@ skipping 157 matching lines @@
   "setUint32", DataViewSetUint32JS,
 
   "getFloat32", DataViewGetFloat32JS,
   "setFloat32", DataViewSetFloat32JS,
 
   "getFloat64", DataViewGetFloat64JS,
   "setFloat64", DataViewSetFloat64JS
 ]);
 
 })