Construct instances of base class from TypedArray.prototype.subarray

Previous changes with subclassable builtins and @@species were a bit
aggressive in making TypedArray.prototype.subarray act like the
ES2016 specification in terms of returning an instance of the
subclass as a result. It turns out that Node.js, and extracted
libraries for the web, subclass TypedArrays but don't expect the
subclass constructor to be called by subarray. @@species will provide
an escape hatch, but it has not shipped yet, and will take some time
for uptake by libraries.

For now, this patch makes TypedArray.prototype.subarray fall back to
constructing an instance of the parent TypedArray class, such as
Uint8Array.

R=adamk
LOG=Y
BUG=v8:4665

Review URL: https://codereview.chromium.org/1583773005

Cr-Commit-Position: refs/heads/master@{#33312}

src/js/typedarray.js

@@ -128,9 +128,10 @@ function TypedArrayCreate(constructor, arg0, arg1, arg2) {
   return newTypedArray;
 }
 
-function TypedArraySpeciesCreate(exemplar, arg0, arg1, arg2) {
+function TypedArraySpeciesCreate(exemplar, arg0, arg1, arg2, conservative) {
   var defaultConstructor = TypedArrayDefaultConstructor(exemplar);
-  var constructor = SpeciesConstructor(exemplar, defaultConstructor);
+  var constructor = SpeciesConstructor(exemplar, defaultConstructor,
+                                       conservative);
   return TypedArrayCreate(constructor, arg0, arg1, arg2);
 }
 
@@ -292,7 +293,7 @@ function NAMESubArray(begin, end) {
   var beginByteOffset =
       %_ArrayBufferViewGetByteOffset(this) + beginInt * ELEMENT_SIZE;
   return TypedArraySpeciesCreate(this, %TypedArrayGetBuffer(this),
-                                 beginByteOffset, newLength);
+                                 beginByteOffset, newLength, true);
 }
 endmacro
 

test/mjsunit/es6/legacy-subclassing.js

@@ -33,3 +33,6 @@ class MyPromise extends Promise { }
 let myPromise = new MyPromise(() => {});
 assertEquals(MyPromise, myPromise.constructor);
 assertEquals(MyPromise, myPromise.then().constructor);
+
+// However, subarray instantiates members of the parent class
+assertEquals(Uint8Array, myTypedArray.subarray(1).constructor);

test/mjsunit/regress/regress-4665.js

@@ -0,0 +1,33 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --noharmony-species
+
+// First test case
+
+function FirstBuffer () {}
+FirstBuffer.prototype.__proto__ = Uint8Array.prototype
+FirstBuffer.__proto__ = Uint8Array
+
+var buf = new Uint8Array(10)
+buf.__proto__ = FirstBuffer.prototype
+
+var buf2 = buf.subarray(2)
+assertEquals(8, buf2.length);
+
+// Second test case
+
+function SecondBuffer (arg) {
+  var arr = new Uint8Array(arg)
+  arr.__proto__ = SecondBuffer.prototype
+  return arr
+}
+SecondBuffer.prototype.__proto__ = Uint8Array.prototype
+SecondBuffer.__proto__ = Uint8Array
+
+var buf3 = new SecondBuffer(10)
+
+var buf4 = buf3.subarray(2)
+
+assertEquals(8, buf4.length);