[typedarrays] check byte offset for fast typedarray sort

src/runtime/runtime-typedarray.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/factory.h"
 #include "src/messages.h"
 #include "src/objects-inl.h"
@@ skipping 357 matching lines @@
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, array, JSTypedArray::Validate(isolate, target_obj, method));
 
   // This line can be removed when JSTypedArray::Validate throws
   // if array.[[ViewedArrayBuffer]] is neutered(v8:4648)
   if (V8_UNLIKELY(array->WasNeutered())) return *array;
 
   size_t length = array->length_value();
   if (length <= 1) return *array;
 
+  Handle<FixedTypedArrayBase> elements(
+      FixedTypedArrayBase::cast(array->elements()));
   switch (array->type()) {
-#define TYPED_ARRAY_SORT(Type, type, TYPE, ctype, size)                    \
-  case kExternal##Type##Array: {                                           \
-    ctype* backing_store =                                                 \
-        static_cast<ctype*>(array->GetBuffer()->backing_store());          \
-    if (kExternal##Type##Array == kExternalFloat64Array ||                 \
-        kExternal##Type##Array == kExternalFloat32Array)                   \
-      std::sort(backing_store, backing_store + length, CompareNum<ctype>); \
-    else                                                                   \
-      std::sort(backing_store, backing_store + length);                    \
-    break;                                                                 \
+#define TYPED_ARRAY_SORT(Type, type, TYPE, ctype, size)     \
+  case kExternal##Type##Array: {                            \
+    ctype* data = static_cast<ctype*>(elements->DataPtr()); \
+    if (kExternal##Type##Array == kExternalFloat64Array ||  \
+        kExternal##Type##Array == kExternalFloat32Array)    \
+      std::sort(data, data + length, CompareNum<ctype>);    \
+    else                                                    \
+      std::sort(data, data + length);                       \
+    break;                                                  \
   }
 
     TYPED_ARRAYS(TYPED_ARRAY_SORT)
 #undef TYPED_ARRAY_SORT
   }
 
   return *array;
 }
 
 RUNTIME_FUNCTION(Runtime_TypedArrayMaxSizeInHeap) {
@@ skipping 42 matching lines @@
     return isolate->heap()->false_value();
   }
 
   Handle<JSTypedArray> obj(JSTypedArray::cast(args[0]));
   return isolate->heap()->ToBoolean(obj->GetBuffer()->is_shared() &&
                                     obj->type() == kExternalInt32Array);
 }
 
 }  // namespace internal
 }  // namespace v8