Add checks for detached ArrayBuffers to ArrayBuffer.prototype.slice

src/js/arraybuffer.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 52 matching lines @@
   if (fin < first) {
     fin = first;
   }
   var newLen = fin - first;
   var constructor = SpeciesConstructor(this, GlobalArrayBuffer, true);
   var result = new constructor(newLen);
   if (!IS_ARRAYBUFFER(result)) {
     throw MakeTypeError(kIncompatibleMethodReceiver,
                         'ArrayBuffer.prototype.slice', result);
   }
-  // TODO(littledan): Check for a detached ArrayBuffer
+  // Checks for detached source/target ArrayBuffers are done inside of
+  // %ArrayBufferSliceImpl; the reordering of checks does not violate
+  // the spec because all exceptions thrown are TypeErrors.
   if (result === this) {
     throw MakeTypeError(kArrayBufferSpeciesThis);
   }
   if (%_ArrayBufferGetByteLength(result) < newLen) {
     throw MakeTypeError(kArrayBufferTooShort);
   }
 
   %ArrayBufferSliceImpl(this, result, first, newLen);
   return result;
 }
 
 utils.InstallGetter(GlobalArrayBuffer.prototype, "byteLength",
                     ArrayBufferGetByteLen);
 
 utils.InstallFunctions(GlobalArrayBuffer.prototype, DONT_ENUM, [
   "slice", ArrayBufferSlice
 ]);
 
 })