[builtins] throw if TypedArray buffer is detached during iteration

test/mjsunit/es6/array-iterator-detached.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// See Runtime_GetOptimizationStatus in runtime-test.cc
+const kInterpreted = 8;
+const kNo = 2;
+
+function Baseline() {
+  let array = new Uint8Array([0, 1, 2, 3, 4, 5, 6, 7, 8, 9]);
+
+  let it = array[Symbol.iterator]();
+  assertEquals(0, it.next().value);
+  assertEquals(1, it.next().value);
+  assertEquals(2, it.next().value);
+  %ArrayBufferNeuter(array.buffer);
+  it.next();
+};
+%NeverOptimizeFunction(Baseline);
+
+assertThrows(Baseline, TypeError,
+    "Cannot perform Array Iterator.prototype.next on a detached ArrayBuffer");
+
+let state = kNo;
+function Turbo(count = 10000) {
+  let array = Array(10000);
+  for (let i = 0; i < 10000; ++i) {
+    array[i] = 254;
+  }
+  array[5000] = 255;
+  array = new Uint8Array(array);
+
+  let sum = 0;
+  let it = array[Symbol.iterator]();
+  for (let i = 0; i < count; ++i) {
+    let result = it.next();
+    if (result.value === 255) {
+      state = %GetOptimizationStatus(Turbo);
+      %ArrayBufferNeuter(array.buffer);
+    }
+    sum += result.value;
+  }
+  return sum;
+}
+
+Turbo(10);
+Turbo(10);
+%OptimizeFunctionOnNextCall(Turbo);
+
+assertThrows(Turbo, TypeError,
+    "Cannot perform Array Iterator.prototype.next on a detached ArrayBuffer");
+assertTrue(state !== kInterpreted && state !== kNo,

[Benedikt Meurer, 2017/01/03 18:09:39]

This is very brittle. I'd rather have a high-level blackbox test, which doesn't
require peaking into the optimizatio state.

[caitp, 2017/01/03 18:18:40]

Fair enough

+    "Turbo should be optimized using TurboFan backend, but was " + state);