Version 4.5.103.17 (cherry-pick)

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index d27247175cd49ccb75909488c436dec7233808f3..f919d422c9c3e3cffadf0ac65f2d5573acf96623 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3298,6 +3298,12 @@ MaybeHandle<Object> Object::SetDataProperty(LookupIterator* it,
       // have been invalidated since typed array elements cannot be reconfigured
       // in any way.
       it->ReloadHolderMap();
+
+      // We have to recheck the length. However, it can only change if the
+      // underlying buffer was neutered, so just check that.
+      if (Handle<JSArrayBufferView>::cast(receiver)->WasNeutered()) {
+        return value;
+      }
     }
   }