Normative: Update RevalidateAtomicAccess to account for all bytes of a TypedArray element

[gibson042]

Fixes #3924
Ref #3200

[github-actions]

The rendered spec preview for this PR is available as a single page at https://tc39.es/ecma262/pr/3926 and as multiple pages at https://tc39.es/ecma262/pr/3926/multipage .

[gibson042]

Atomics.notify notably does not use RevalidateAtomicAccess, so shrinking a length-tracking TypedArray in e.g. index.valueOf and then returning an index made out-of-bounds by the resize does not throw an exception (Atomics.notify(ta, { valueOf() { assert(ta.length > 0); ta.buffer.resize(0); assert(ta.length === 0); return 0; } }) === 0, except that V8 does seem to revalidate). But the primary use for Atomics.notify is with TypedArrays backed by shared ArrayBuffers, which cannot shrink and thus cannot encounter such a scenario. This PR preserves the behavior; I just thought it'd be worth highlighting.

[michaelficarra]

Oops, let's see a test262 PR before we merge.

[gibson042]

test262 PR: tc39/test262#5106

JavaScriptCore and V8 incorrectly throw TypeError rather than RangeError when the TypedArray is length-tracking, and Moddable XS incorrectly fails to throw exceptions at all.

[nicolo-ribaudo]

If 3 implementations need changes due to this PR then you should present it for consensus, as it isn't really "web reality".

[gibson042]

If 3 implementations need changes due to this PR then you should present it for consensus, as it isn't really "web reality".

I guess I should clarify that none of those changes are needed due to this PR, but rather are consistent with current conforming/nonconforming behavior for shrinking a backing ArrayBuffer by a whole number of elements.

I still think "web reality" makes sense.

Shrinking a fixed-length TypedArray's buffer inside index.valueOf

RevalidateAtomicAccess specifies a TypeError via ValidateTypedArrayBounds (not changed by this PR).

All implementations other than XS conform

$ eshost -si gh-3924.js
## Source
if (typeof Atomics !== "undefined" && ArrayBuffer.prototype.resize) {
  const rab = new ArrayBuffer(4, { maxByteLength: 4 });
  const ta = new Int32Array(rab, 0, 1);
  try {
    const rugPull = () => {
      rab.resize(0);
      return 0;
    };
    print(`unexpected result ${Atomics.or(ta, { valueOf: rugPull }, "0")}`);
  } catch(err) {
    print(`<${err.name}>`);
  }
}

#### JavaScriptCore, LibJS, QuickJS, SpiderMonkey, V8
<TypeError>

#### Moddable XS
unexpected result 0

Shrinking a length-tracking TypedArray's buffer inside index.valueOf

RevalidateAtomicAccess specifies a RangeError (not changed by this PR).

All implementations other than XS throw an error, but in JavaScriptCore and V8 it is incorrectly a TypeError

$ eshost -si gh-3924.js
## Source
if (typeof Atomics !== "undefined" && ArrayBuffer.prototype.resize) {
  const rab = new ArrayBuffer(4, { maxByteLength: 4 });
  const ta = new Int32Array(rab);
  try {
    const rugPull = () => {
      rab.resize(0);
      return 0;
    };
    print(`unexpected result ${Atomics.or(ta, { valueOf: rugPull }, "0")}`);
  } catch(err) {
    print(`<${err.name}>`);
  }
}

#### JavaScriptCore, V8
<TypeError>

#### LibJS, QuickJS, SpiderMonkey
<RangeError>

#### Moddable XS
unexpected result 0