runtime: DataView constructor validation + byteLength/byteOffset semantics #3657

Summary

DataView constructor semantics are incomplete: ~40 built-ins/DataView
runtime cases fail (separate from the name/length own-property cluster,
which is its own issue). Two sub-problems:

1. Missing argument-validation throws — out-of-range / invalid byteOffset
   and byteLength, and non-object buffer, do not throw where the spec
   requires a RangeError/TypeError.
2. byteLength/byteOffset accessors return wrong values — SameValue checks
   on a constructed DataView's properties fail.

Note: #2447 covers TypedArray (map/filter/reduce/slice/indexOf raw-storage bug) —
it is TypedArray-specific and does not cover the DataView constructor.

Evidence

From a test262 parity sweep (2026-05-31), built-ins/DataView runtime-fails:

Validation (should throw, Perry doesn't):

• buffer-not-object-throws.js
• byteoffset-is-negative-throws.js
• negative-bytelength-throws.js, negative-byteoffset-throws.js
• excessive-bytelength-throws.js, excessive-byteoffset-throws.js

Wrong property values (SameValue mismatch):

• defined-bytelength-and-byteoffset.js
• defined-byteoffset-undefined-bytelength.js
• defined-byteoffset.js
• instance-extensibility.js

Repro

const ab = new ArrayBuffer(8);
try { new DataView(ab, -1); console.log('NO THROW (bug)'); }
catch (e) { console.log('threw', e.constructor.name); }   // expect RangeError

const dv = new DataView(ab, 2, 4);
console.log(dv.byteOffset, dv.byteLength);  // expect 2 4

Suggested scope

Implement the DataView(buffer, byteOffset, byteLength) spec steps:
ToIndex/range validation against the buffer's byteLength (throwing
RangeError/TypeError), and correct byteOffset/byteLength/buffer accessors.
The throw side overlaps with the broader arg-validation work in #3146; this issue
scopes the DataView-specific constructor.

Filed from the parity-gap radar (scripts/parity_gap_report.py). Cluster: ~40
DataView runtime failures (excl. name/length). Related: #3146, #2447.