[typedarrays] Use internal byteOffset in TypedArray.prototype.set

src/js/typedarray.js

Index: src/js/typedarray.js
diff --git a/src/js/typedarray.js b/src/js/typedarray.js
index e4556b706a53fdff42a61693bebbfef90ed8dad2..f54ed29a4818b9ff4aab4a40183e0b3c10b542e0 100644
--- a/src/js/typedarray.js
+++ b/src/js/typedarray.js
@@ -282,10 +282,11 @@ function TypedArraySetFromOverlappingTypedArray(target, source, offset) {
   // Copy left part.
   function CopyLeftPart() {
     // First un-mutated byte after the next write
-    var targetPtr = target.byteOffset + (offset + 1) * targetElementSize;
+    var targetPtr = %_ArrayBufferViewGetByteOffset(target) +
+                    (offset + 1) * targetElementSize;
     // Next read at sourcePtr. We do not care for memory changing before
     // sourcePtr - we have already copied it.
-    var sourcePtr = source.byteOffset;
+    var sourcePtr = %_ArrayBufferViewGetByteOffset(source);
     for (var leftIndex = 0;
          leftIndex < sourceLength && targetPtr <= sourcePtr;
          leftIndex++) {
@@ -300,12 +301,12 @@ function TypedArraySetFromOverlappingTypedArray(target, source, offset) {
   // Copy right part;
   function CopyRightPart() {
     // First unmutated byte before the next write
-    var targetPtr =
-      target.byteOffset + (offset + sourceLength - 1) * targetElementSize;
+    var targetPtr = %_ArrayBufferViewGetByteOffset(target) +
+                    (offset + sourceLength - 1) * targetElementSize;
     // Next read before sourcePtr. We do not care for memory changing after
     // sourcePtr - we have already copied it.
-    var sourcePtr =
-      source.byteOffset + sourceLength * sourceElementSize;
+    var sourcePtr = %_ArrayBufferViewGetByteOffset(source) +
+                    sourceLength * sourceElementSize;
     for(var rightIndex = sourceLength - 1;
         rightIndex >= leftIndex && targetPtr >= sourcePtr;
         rightIndex--) {