Merged: Revert "PPC/S390: [typedarray] Make JSTypedArray::length auth…

…oritative."

Revision: f59744fe9ffeee1116215e23bf182ddee9fb2f67

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=miladfar@ca.ibm.com
TBR=bmeurer@chromium.org, jarin@chromium.org, titzer@chromium.org

Change-Id: Id544a8f7b9bb64c99ccfc1155fd892d1cf1e638f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1598750
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.5@{#20}
Cr-Branched-From: 35b9bf5-refs/heads/7.5.288@{#1}
Cr-Branched-From: 912b391-refs/heads/master@{#60911}

src/runtime/runtime-atomics.cc

@@ -361,7 +361,7 @@ Object GetModifySetValueInBuffer(Arguments args, Isolate* isolate) {
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, bigint,
                                        BigInt::FromObject(isolate, value_obj));
     // SharedArrayBuffers are not detachable.
-    CHECK_LT(index, sta->length());
+    CHECK_LT(index, NumberToSize(sta->length()));
     if (sta->type() == kExternalBigInt64Array) {
       return Op<int64_t>::Do(isolate, source, index, bigint);
     }
@@ -373,7 +373,7 @@ Object GetModifySetValueInBuffer(Arguments args, Isolate* isolate) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
                                      Object::ToInteger(isolate, value_obj));
   // SharedArrayBuffers are not detachable.
-  CHECK_LT(index, sta->length());
+  CHECK_LT(index, NumberToSize(sta->length()));
 
   switch (sta->type()) {
 #define TYPED_ARRAY_CASE(Type, typeName, TYPE, ctype) \
@@ -403,7 +403,7 @@ RUNTIME_FUNCTION(Runtime_AtomicsLoad64) {
   DCHECK(sta->type() == kExternalBigInt64Array ||
          sta->type() == kExternalBigUint64Array);
   // SharedArrayBuffers are not detachable.
-  CHECK_LT(index, sta->length());
+  CHECK_LT(index, NumberToSize(sta->length()));
   if (sta->type() == kExternalBigInt64Array) {
     return Load<int64_t>::Do(isolate, source, index);
   }
@@ -429,7 +429,7 @@ RUNTIME_FUNCTION(Runtime_AtomicsStore64) {
   DCHECK(sta->type() == kExternalBigInt64Array ||
          sta->type() == kExternalBigUint64Array);
   // SharedArrayBuffers are not detachable.
-  CHECK_LT(index, sta->length());
+  CHECK_LT(index, NumberToSize(sta->length()));
   if (sta->type() == kExternalBigInt64Array) {
     Store<int64_t>::Do(isolate, source, index, bigint);
     return *bigint;
@@ -451,7 +451,7 @@ RUNTIME_FUNCTION(Runtime_AtomicsCompareExchange) {
   CONVERT_ARG_HANDLE_CHECKED(Object, old_value_obj, 2);
   CONVERT_ARG_HANDLE_CHECKED(Object, new_value_obj, 3);
   CHECK(sta->GetBuffer()->is_shared());
-  CHECK_LT(index, sta->length());
+  CHECK_LT(index, NumberToSize(sta->length()));
 
   uint8_t* source = static_cast<uint8_t*>(sta->GetBuffer()->backing_store()) +
                     sta->byte_offset();
@@ -464,7 +464,7 @@ RUNTIME_FUNCTION(Runtime_AtomicsCompareExchange) {
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, new_bigint, BigInt::FromObject(isolate, new_value_obj));
     // SharedArrayBuffers are not detachable.
-    CHECK_LT(index, sta->length());
+    CHECK_LT(index, NumberToSize(sta->length()));
     if (sta->type() == kExternalBigInt64Array) {
       return DoCompareExchange<int64_t>(isolate, source, index, old_bigint,
                                         new_bigint);
@@ -481,7 +481,7 @@ RUNTIME_FUNCTION(Runtime_AtomicsCompareExchange) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, new_value,
                                      Object::ToInteger(isolate, new_value_obj));
   // SharedArrayBuffers are not detachable.
-  CHECK_LT(index, sta->length());
+  CHECK_LT(index, NumberToSize(sta->length()));
 
   switch (sta->type()) {
 #define TYPED_ARRAY_CASE(Type, typeName, TYPE, ctype)                  \