Check whether a typed array was neutered before writing to it

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 8bb95c518c79327fe1548fcdf8cf017a9004cd16..4f3c1295a2419b16dc517a1cde806577d1e83542 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3322,6 +3322,12 @@ MaybeHandle<Object> Object::SetDataProperty(LookupIterator* it,
       // have been invalidated since typed array elements cannot be reconfigured
       // in any way.
       it->ReloadHolderMap();
+
+      // We have to recheck the length. However, it can only change if the
+      // underlying buffer was neutered, so just check that.
+      if (Handle<JSArrayBufferView>::cast(receiver)->WasNeutered()) {
+        return value;
+      }
     }
   }