[SAB] Fix {newtarget-prototype-is-not-object,proto-from-ctor-realm} tests

src/js/typedarray.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 129 matching lines @@
 }
 
 // ES#sec-typedarray-typedarray TypedArray ( typedArray )
 function NAMEConstructByTypedArray(obj, typedArray) {
   // TODO(littledan): Throw on detached typedArray
   var srcData = %TypedArrayGetBuffer(typedArray);
   var length = %_TypedArrayGetLength(typedArray);
   var byteLength = %_ArrayBufferViewGetByteLength(typedArray);
   var newByteLength = length * ELEMENT_SIZE;
   %typed_array_construct_by_array_like(obj, typedArray, length, ELEMENT_SIZE);
-  var bufferConstructor = SpeciesConstructor(srcData, GlobalArrayBuffer);
+  // The spec requires that constructing a typed array using a SAB-backed typed
+  // array use the ArrayBuffer constructor, not the species constructor. See
+  // https://tc39.github.io/ecma262/#sec-typedarray-typedarray.
+  var bufferConstructor = IS_SHAREDARRAYBUFFER(srcData)
+                            ? GlobalArrayBuffer
+                            : SpeciesConstructor(srcData, GlobalArrayBuffer);
   var prototype = bufferConstructor.prototype;
   // TODO(littledan): Use the right prototype based on bufferConstructor's realm
   if (IS_RECEIVER(prototype) && prototype !== GlobalArrayBufferPrototype) {
     %InternalSetPrototype(%TypedArrayGetBuffer(obj), prototype);
   }
 }
 
 function NAMEConstructor(arg1, arg2, arg3) {
   if (!IS_UNDEFINED(new.target)) {
     if (IS_ARRAYBUFFER(arg1) || IS_SHAREDARRAYBUFFER(arg1)) {
@@ skipping 528 matching lines @@
   %AddNamedProperty(GlobalNAME.prototype,
                     "constructor", global.NAME, DONT_ENUM);
   %AddNamedProperty(GlobalNAME.prototype,
                     "BYTES_PER_ELEMENT", ELEMENT_SIZE,
                     READ_ONLY | DONT_ENUM | DONT_DELETE);
 endmacro
 
 TYPED_ARRAYS(SETUP_TYPED_ARRAY)
 
 })