Do not look up ArrayBuffer on global object in typed array constructor.

test/mjsunit/regress/regress-2931.js

Index: test/mjsunit/regress/regress-2931.js
diff --git a/test/mjsunit/regress/regress-294.js b/test/mjsunit/regress/regress-2931.js
similarity index 88%
copy from test/mjsunit/regress/regress-294.js
copy to test/mjsunit/regress/regress-2931.js
index 285b447fb570a771a4aa6eb308ead47e3a62ced7..a2ea912682dacb545fc304462b7c2055ea2a9932 100644
--- a/test/mjsunit/regress/regress-294.js
+++ b/test/mjsunit/regress/regress-2931.js
@@ -25,19 +25,10 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Should not crash.
+// Typed array constructors should be immune from changes to
+// value of ArrayBuffer on global object.
 // See http://code.google.com/p/v8/issues/detail?id=294
 
-function f() { return false; }
-
-function test(x) {
-  var y = x;
-  if (x == "kat") x = "kat";
-  else {
-    x = "hund";
-    var z = f();
-    if (!z) x = "kat";
-  }
-}
-
-test("hund");
+this.ArrayBuffer = function() { throw Error('BAM'); };
+var u8 = new Uint8Array(100);
+assertSame(100, u8.byteLength);