[accessors] second-chance typed array field lookup

test/mjsunit/regress/regress-typedarray-length.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
 var a = new Int32Array(100);
 a.__proto__ = null;
 
 function get(a) {
@@ skipping 53 matching lines @@
     return a.length;
   }
 
   assertEquals(undefined, get(a));
   assertEquals(undefined, get(a));
   assertEquals(undefined, get(a));
   %OptimizeFunctionOnNextCall(get);
   assertEquals(undefined, get(a));
 })();
 
+(function() {
+  "use strict";
+
+  class MyTypedArray extends Int32Array {
+    constructor(length) {
+      super(length);
+    }
+  }
+
+  a = new MyTypedArray(1024);
+
+  get = function(a) {
+    return a.length;
+  }
+
+  assertEquals(1024, get(a));
+  assertEquals(1024, get(a));
+  assertEquals(1024, get(a));
+  %OptimizeFunctionOnNextCall(get);
+  assertEquals(1024, get(a));
+})();
+
 // Ensure we cannot delete length, byteOffset, byteLength.
 assertTrue(Int32Array.prototype.hasOwnProperty("length"));
 assertTrue(Int32Array.prototype.hasOwnProperty("byteOffset"));
 assertTrue(Int32Array.prototype.hasOwnProperty("byteLength"));
 assertFalse(delete Int32Array.prototype.length);
 assertFalse(delete Int32Array.prototype.byteOffset);
 assertFalse(delete Int32Array.prototype.byteLength);
 
 a = new Int32Array(100);
 
@@ skipping 19 matching lines @@
 
 get = function(a) {
   return a.byteOffset;
 }
 
 assertEquals(0, get(a));
 assertEquals(0, get(a));
 assertEquals(0, get(a));
 %OptimizeFunctionOnNextCall(get);
 assertEquals(0, get(a));