[builtins] Migrate SharedArrayBuffer.byteLength to C++.

test/mjsunit/harmony/sharedarraybuffer.js

Index: test/mjsunit/harmony/sharedarraybuffer.js
diff --git a/test/mjsunit/harmony/sharedarraybuffer.js b/test/mjsunit/harmony/sharedarraybuffer.js
index 7bd4e5b121e99fcb7684e9f7d3000cd0380cd39d..7c34ed3009224b3fdd389131a6de5e80695cb683 100644
--- a/test/mjsunit/harmony/sharedarraybuffer.js
+++ b/test/mjsunit/harmony/sharedarraybuffer.js
@@ -572,3 +572,21 @@ for(i = 0; i < typedArrayConstructors.length; i++) {
   assertThrows(function(i) { typedArrayConstructors[i](); }.bind(this, i),
                TypeError);
 }
+
+// byteLength from prototype can be overwritten
+var s = new SharedArrayBuffer(10);
+assertEquals(10, s.byteLength);
+Object.defineProperty(s, 'byteLength', {value: 42});
+assertEquals(42, s.byteLength);
+
+// byteLength on incompatible type (shared vs. regular ArrayBuffer)
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'byteLength');
+s = new SharedArrayBuffer(10);
+Object.defineProperty(s, 'byteLength', desc);
+assertThrows(function() {s.byteLength}, TypeError);
+
+desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype,
+  'byteLength');
+var a = new ArrayBuffer(10);
+Object.defineProperty(a, 'byteLength', desc);
+assertThrows(function() {a.byteLength}, TypeError);