| Index: src/builtins/builtins-typedarray.cc
 | 
| diff --git a/src/builtins/builtins-typedarray.cc b/src/builtins/builtins-typedarray.cc
 | 
| index 5f061651584c9cf02c896cf8fe4e48bc38f62d83..8cf7a930a0e023e9b1698f5e3c4f659f78ea0f1a 100644
 | 
| --- a/src/builtins/builtins-typedarray.cc
 | 
| +++ b/src/builtins/builtins-typedarray.cc
 | 
| @@ -464,8 +464,6 @@ BUILTIN(TypedArrayPrototypeCopyWithin) {
 | 
|    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 | 
|        isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
 | 
|  
 | 
| -  if (V8_UNLIKELY(array->WasNeutered())) return *array;
 | 
| -
 | 
|    int64_t len = array->length_value();
 | 
|    int64_t to = 0;
 | 
|    int64_t from = 0;
 | 
| @@ -521,6 +519,53 @@ BUILTIN(TypedArrayPrototypeCopyWithin) {
 | 
|    return *array;
 | 
|  }
 | 
|  
 | 
| +BUILTIN(TypedArrayPrototypeFill) {
 | 
| +  HandleScope scope(isolate);
 | 
| +
 | 
| +  Handle<JSTypedArray> array;
 | 
| +  const char* method = "%TypedArray%.prototype.fill";
 | 
| +  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 | 
| +      isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
 | 
| +
 | 
| +  int64_t len = array->length_value();
 | 
| +  int64_t start = 0;
 | 
| +  int64_t end = len;
 | 
| +
 | 
| +  if (args.length() > 2) {
 | 
| +    Handle<Object> num = args.atOrUndefined(isolate, 2);
 | 
| +    if (!num->IsUndefined(isolate)) {
 | 
| +      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 | 
| +          isolate, num, Object::ToInteger(isolate, num));
 | 
| +      start = CapRelativeIndex(num, 0, len);
 | 
| +
 | 
| +      num = args.atOrUndefined(isolate, 3);
 | 
| +      if (!num->IsUndefined(isolate)) {
 | 
| +        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 | 
| +            isolate, num, Object::ToInteger(isolate, num));
 | 
| +        end = CapRelativeIndex(num, 0, len);
 | 
| +      }
 | 
| +    }
 | 
| +  }
 | 
| +
 | 
| +  int64_t count = end - start;
 | 
| +  if (count <= 0) return *array;
 | 
| +
 | 
| +  if (V8_UNLIKELY(array->WasNeutered())) return *array;
 | 
| +
 | 
| +  // Ensure processed indexes are within array bounds
 | 
| +  DCHECK_GE(start, 0);
 | 
| +  DCHECK_LT(start, len);
 | 
| +  DCHECK_GE(end, 0);
 | 
| +  DCHECK_LE(end, len);
 | 
| +  DCHECK_LE(count, len);
 | 
| +
 | 
| +  Handle<Object> obj_value = args.at<Object>(1);
 | 
| +
 | 
| +  return array->GetElementsAccessor()->Fill(isolate, array, obj_value,
 | 
| +                                            static_cast<uint32_t>(start),
 | 
| +                                            static_cast<uint32_t>(end));
 | 
| +}
 | 
| +
 | 
|  BUILTIN(TypedArrayPrototypeIncludes) {
 | 
|    HandleScope scope(isolate);
 | 
|  
 | 
| 
 |