TypedArray.prototype.set uses internal length property, not real one.

src/js/typedarray.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 331 matching lines @@
   else {
     for (var i = 0; i < sourceLength; i++) {
       target[i] = source[i];
     }
   }
 }
 
 function TypedArraySetFromOverlappingTypedArray(target, source, offset) {
   var sourceElementSize = source.BYTES_PER_ELEMENT;
   var targetElementSize = target.BYTES_PER_ELEMENT;
-  var sourceLength = source.length;
+  var sourceLength = %_TypedArrayGetLength(source);
 
   // Copy left part.
   function CopyLeftPart() {
     // First un-mutated byte after the next write
     var targetPtr = target.byteOffset + (offset + 1) * targetElementSize;
     // Next read at sourcePtr. We do not care for memory changing before
     // sourcePtr - we have already copied it.
     var sourcePtr = source.byteOffset;
     for (var leftIndex = 0;
          leftIndex < sourceLength && targetPtr <= sourcePtr;
          leftIndex++) {
       target[offset + leftIndex] = source[leftIndex];
       targetPtr += targetElementSize;
       sourcePtr += sourceElementSize;
     }
     return leftIndex;
   }
   var leftIndex = CopyLeftPart();
 
-  // Copy rigth part;
+  // Copy right part;
   function CopyRightPart() {
     // First unmutated byte before the next write
     var targetPtr =
       target.byteOffset + (offset + sourceLength - 1) * targetElementSize;
     // Next read before sourcePtr. We do not care for memory changing after
     // sourcePtr - we have already copied it.
     var sourcePtr =
       source.byteOffset + sourceLength * sourceElementSize;
     for(var rightIndex = sourceLength - 1;
         rightIndex >= leftIndex && targetPtr >= sourcePtr;
@@ skipping 23 matching lines @@
     throw MakeRangeError(kTypedArraySetSourceTooLarge);
   }
   switch (%TypedArraySetFastCases(this, obj, intOffset)) {
     // These numbers should be synchronized with runtime.cc.
     case 0: // TYPED_ARRAY_SET_TYPED_ARRAY_SAME_TYPE
       return;
     case 1: // TYPED_ARRAY_SET_TYPED_ARRAY_OVERLAPPING
       TypedArraySetFromOverlappingTypedArray(this, obj, intOffset);
       return;
     case 2: // TYPED_ARRAY_SET_TYPED_ARRAY_NONOVERLAPPING
-      TypedArraySetFromArrayLike(this, obj, obj.length, intOffset);
+      TypedArraySetFromArrayLike(this, obj, %_TypedArrayGetLength(obj), intOffset);

[Dan Ehrenberg, 2016/06/23 22:12:40]

Wrap line longer than 80 chars

[bakkot, 2016/06/23 22:17:46]

Done.

       return;
     case 3: // TYPED_ARRAY_SET_NON_TYPED_ARRAY
       var l = obj.length;
       if (IS_UNDEFINED(l)) {
         if (IS_NUMBER(obj)) {
             // For number as a first argument, throw TypeError
             // instead of silently ignoring the call, so that
             // the user knows (s)he did something wrong.
             // (Consistent with Firefox and Blink/WebKit)
             throw MakeTypeError(kInvalidArgument);
         }
         return;
       }
       l = TO_LENGTH(l);
-      if (intOffset + l > this.length) {
+      if (intOffset + l > %_TypedArrayGetLength(this)) {
         throw MakeRangeError(kTypedArraySetSourceTooLarge);
       }
       TypedArraySetFromArrayLike(this, obj, l, intOffset);
       return;
   }
 }
 %FunctionSetLength(TypedArraySet, 1);
 
 function TypedArrayGetToStringTag() {
   if (!IS_TYPEDARRAY(this)) return;
@@ skipping 457 matching lines @@
   "setUint32", DataViewSetUint32JS,
 
   "getFloat32", DataViewGetFloat32JS,
   "setFloat32", DataViewSetFloat32JS,
 
   "getFloat64", DataViewGetFloat64JS,
   "setFloat64", DataViewSetFloat64JS
 ]);
 
 })