TypedArray.prototype.set uses internal length property, not real one.

TypedArray.prototype.set uses internal length property, not real one.

TypedArrays store their true length in an internal slot. This is
normally reflected in the .length property, but that property is
configurable. Algorithms which need the length of a typed array are to
use the internal slot, not the property; TypedArray.prototype.set was
not doing this.

BUG=v8:5133
Committed: https://crrev.com/9f2a18b729d604b27f7aa1ce6bf44e1452690baa
Cr-Commit-Position: refs/heads/master@{#37232}

[bakkot, 2016-06-23 22:09:47]

Description was changed from

==========
TypedArray.prototype.set uses internal length property, not real one.

TypedArrays store their true length in an internal slot. This is
normally reflected in the .length property, but that property is
configurable. Algorithms which need the length of a typed array are to
use the internal slot, not the property; TypedArray.prototype.set was
not doing this.

BUG=5133
==========

to

==========
TypedArray.prototype.set uses internal length property, not real one.

TypedArrays store their true length in an internal slot. This is
normally reflected in the .length property, but that property is
configurable. Algorithms which need the length of a typed array are to
use the internal slot, not the property; TypedArray.prototype.set was
not doing this.

BUG=v8:5133
==========

[bakkot, 2016-06-23 22:09:47]

bakkot@google.com changed reviewers:
+ littledan@chromium.org

[Dan Ehrenberg, 2016-06-23 22:12:40]

Looks good, just a nit pick

https://codereview.chromium.org/2091153002/diff/1/src/js/typedarray.js
File src/js/typedarray.js (right):

https://codereview.chromium.org/2091153002/diff/1/src/js/typedarray.js#newcod...
src/js/typedarray.js:416: TypedArraySetFromArrayLike(this, obj,
%_TypedArrayGetLength(obj), intOffset);
Wrap line longer than 80 chars

[bakkot, 2016-06-23 22:17:46]

https://codereview.chromium.org/2091153002/diff/1/src/js/typedarray.js
File src/js/typedarray.js (right):

https://codereview.chromium.org/2091153002/diff/1/src/js/typedarray.js#newcod...
src/js/typedarray.js:416: TypedArraySetFromArrayLike(this, obj,
%_TypedArrayGetLength(obj), intOffset);
On 2016/06/23 22:12:40, Dan Ehrenberg wrote:
> Wrap line longer than 80 chars

Done.

[Dan Ehrenberg, 2016-06-23 22:30:19]

lgtm

[bakkot, 2016-06-23 22:30:45]

The CQ bit was checked by bakkot@google.com

[commit-bot: I haz the power, 2016-06-23 22:30:54]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2091153002/20001

[commit-bot: I haz the power, 2016-06-23 22:58:12]

Description was changed from

==========
TypedArray.prototype.set uses internal length property, not real one.

TypedArrays store their true length in an internal slot. This is
normally reflected in the .length property, but that property is
configurable. Algorithms which need the length of a typed array are to
use the internal slot, not the property; TypedArray.prototype.set was
not doing this.

BUG=v8:5133
==========

to

==========
TypedArray.prototype.set uses internal length property, not real one.

TypedArrays store their true length in an internal slot. This is
normally reflected in the .length property, but that property is
configurable. Algorithms which need the length of a typed array are to
use the internal slot, not the property; TypedArray.prototype.set was
not doing this.

BUG=v8:5133
==========

[commit-bot: I haz the power, 2016-06-23 22:58:13]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-06-23 23:00:33]

Description was changed from

==========
TypedArray.prototype.set uses internal length property, not real one.

TypedArrays store their true length in an internal slot. This is
normally reflected in the .length property, but that property is
configurable. Algorithms which need the length of a typed array are to
use the internal slot, not the property; TypedArray.prototype.set was
not doing this.

BUG=v8:5133
==========

to

==========
TypedArray.prototype.set uses internal length property, not real one.

TypedArrays store their true length in an internal slot. This is
normally reflected in the .length property, but that property is
configurable. Algorithms which need the length of a typed array are to
use the internal slot, not the property; TypedArray.prototype.set was
not doing this.

BUG=v8:5133

Committed: https://crrev.com/9f2a18b729d604b27f7aa1ce6bf44e1452690baa
Cr-Commit-Position: refs/heads/master@{#37232}
==========

[commit-bot: I haz the power, 2016-06-23 23:00:38]

Patchset 2 (id:??) landed as
https://crrev.com/9f2a18b729d604b27f7aa1ce6bf44e1452690baa
Cr-Commit-Position: refs/heads/master@{#37232}