Polyfill: two conformance fixes

[rwaldron]

This consolidates two fixes into one PR, but keeps them separate by commit

[rwaldron]

This is replaced by ValidateAtomicAccess(...)

[ExE-Boss]

The ia instanceof TypedArray line should use:

TypedArrayProto_getToStringTag(ia) !== undefined

Which is defined using:

var TypedArrayProto_getToStringTag = Function.prototype.call.bind(
	Object.getOwnPropertyDescriptor(
		Object.getPrototypeOf(Uint8Array.prototype),
		Symbol.toStringTag,
	).get,
);

Refs: https://tc39.es/ecma262/#sec-get-%typedarray%.prototype-@@tostringtag

[ExE-Boss]

And the ia.buffer instanceof SharedArrayBuffer line should instead use:

IsSharedArrayBuffer(ia.buffer)

Which is defined using:

var SharedArrayBufferProto_getByteLength = Function.prototype.call.bind(
	Object.getOwnPropertyDescriptor(
		SharedArrayBuffer.prototype,
		"byteLength",
	).get,
);

function IsSharedArrayBuffer(obj) {
	try {
		SharedArrayBufferProto_getByteLength(obj);
		return true;
	} catch (e) {
		return false;
	}
}