subarray should check if the output Element Size is the same

[petamoriken]

Since %TypedArray%.prototype.subarray does not check whether the Element Size is the same or not, it can refer to buffers outside the area.

const buffer = new Uint16Array([1, 2, 3, 4]).buffer;
console.log(buffer.byteLength); // => 8

class MyArray extends Uint8Array {
  static get [Symbol.species]() {
    return Uint16Array;
  }
}

const myarr = new MyArray(buffer, 0, 4);
console.log(myarr.byteLength); // => 4

// leaks!
const subarray = myarr.subarray();
console.log(subarray); // => Uint16Array(4) [1, 2, 3, 4]
console.log(subarray.byteLength); // => 8

This behavior is both strange and unhelpful. I think it should be fixed, as it is not expected to cause any large breaking changes.