Avoid repeated ToNumber calls in %TypedArray%.prototype.fill()

[camillobruni]

Example:
%TypedArray%.prototype.fill(proxy) causes a ToNumber with side-effects on every fill step.

From the usual behavior of Array.prototype functions, the argument conversion should probably happen only once and in this case would be different for TypedArrays. Obviously this only an issue with non-number fill values.

Array.prototype.fill and %TypedArray%.prototype.fill share the same spec implementation, modulo getting the array length. The TypedArray version should probably introduce an additional step performing a ToNumber(value) before step 3 in 22.1.3.6 to avoid the frequent conversion inside the fill step 7.b.

Steps:
The following steps lead to the ToNumber in question when calling %TypedArray%.prototype.fill.

• In 22.1.3.6 Array.prototype.fill:
  7.b Perform ? Set(O, Pk, value, true).
• In 7.3.3 Set ( O, P, V, Throw ):
  4 Let success be ? O.[[Set]](P, V, O).
• In 9.4.5.5 [[Set]] ( P, V, Receiver ):
  2.b.i Return ? IntegerIndexedElementSet(O, numericIndex, V).
• In 9.4.5.9 IntegerIndexedElementSet(O, numericIndex, V):
  3. Let numValue be ? ToNumber(value).

[littledan]

I wrote up a spec patch with new semantics with only a single coercion, and tests to go along with it. I see a couple advantages to a single coercion:

• It's cleaner semantics. Generally, JavaScript standard library functions tend to coerce things in the beginning of functions once, rather than repeatedly.
• It simplifies implementing an optimized version of TypedArray.prototype.fill. Ideally, we should be able to use memset here under the hood. However, the interspersed coercions with Set mean that implementations would have to include both a memset path which is invoked when value is already a Number, and a "slow path" which will take things more literally to handle, e.g., the underlying ArrayBuffer being detached halfway through in the coercion.

[littledan]

I wrote up a spec patch with new semantics with only a single coercion, and tests to go along with it. I see a couple advantages to a single coercion:

• It's cleaner semantics. Generally, JavaScript standard library functions tend to coerce things in the beginning of functions once, rather than repeatedly.
• It simplifies implementing an optimized version of TypedArray.prototype.fill. Ideally, we should be able to use memset here under the hood. However, the interspersed coercions with Set mean that implementations would have to include both a memset path which is invoked when value is already a Number, and a "slow path" which will take things more literally to handle, e.g., the underlying ArrayBuffer being detached halfway through in the coercion.