[SAB] Fix {newtarget-prototype-is-not-object,proto-from-ctor-realm} tests

src/js/typedarray.js

Index: src/js/typedarray.js
diff --git a/src/js/typedarray.js b/src/js/typedarray.js
index 4cd678e03f9b223d5dc423dcbc5f2f8e63b341d1..3b785cd85356a5e75ed947d6afc98c164872aa7b 100644
--- a/src/js/typedarray.js
+++ b/src/js/typedarray.js
@@ -147,7 +147,12 @@ function NAMEConstructByTypedArray(obj, typedArray) {
   var byteLength = %_ArrayBufferViewGetByteLength(typedArray);
   var newByteLength = length * ELEMENT_SIZE;
   %typed_array_construct_by_array_like(obj, typedArray, length, ELEMENT_SIZE);
-  var bufferConstructor = SpeciesConstructor(srcData, GlobalArrayBuffer);
+  // The spec requires that constructing a typed array using a SAB-backed typed
+  // array use the ArrayBuffer constructor, not the species constructor. See
+  // https://tc39.github.io/ecma262/#sec-typedarray-typedarray.
+  var bufferConstructor = IS_SHAREDARRAYBUFFER(srcData)
+                            ? GlobalArrayBuffer
+                            : SpeciesConstructor(srcData, GlobalArrayBuffer);
   var prototype = bufferConstructor.prototype;
   // TODO(littledan): Use the right prototype based on bufferConstructor's realm
   if (IS_RECEIVER(prototype) && prototype !== GlobalArrayBufferPrototype) {