Fix TypedArray Property optimizations

src/accessors.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/accessors.h"
 
 #include "src/api.h"
 #include "src/contexts.h"
 #include "src/deoptimizer.h"
 #include "src/execution.h"
@@ skipping 98 matching lines @@
       int descriptor = descriptors->SearchWithCache(isolate, *name, *map);
       if (descriptor != DescriptorArray::kNotFound) return false;
 
       Handle<Object> proto = Handle<Object>(map->prototype(), isolate);
       if (!proto->IsJSReceiver()) return false;
 
       // Check if the property is defined in the prototype chain.
       LookupIterator it(proto, name);
       if (!it.IsFound()) return false;
 
-      Object* original_proto =
-          JSFunction::cast(map->GetConstructor())->prototype();
+      Handle<Object> typed_array_proto = isolate->typed_array_prototype();
 
       // Property is not configurable. It is enough to verify that
       // the holder is the same.
-      return *it.GetHolder<Object>() == original_proto;
+      return *it.GetHolder<Object>() == *typed_array_proto;
     }
     case JS_DATA_VIEW_TYPE:
       return CheckForName(name, isolate->factory()->byte_length_string(),
                           JSDataView::kByteLengthOffset, object_offset) ||
              CheckForName(name, isolate->factory()->byte_offset_string(),
                           JSDataView::kByteOffsetOffset, object_offset);
     default:
       return false;
   }
 }
@@ skipping 1069 matching lines @@
   Isolate* isolate = name->GetIsolate();
   Handle<AccessorInfo> info = MakeAccessor(isolate, name, &ModuleGetExport,
                                            &ModuleSetExport, attributes);
   info->set_data(Smi::FromInt(index));
   return info;
 }
 
 
 }  // namespace internal
 }  // namespace v8