[builtins] throw if TypedArray buffer is detached during iteration

test/mjsunit/es6/array-iterator-detached.js

Index: test/mjsunit/es6/array-iterator-detached.js
diff --git a/test/mjsunit/es6/array-iterator-detached.js b/test/mjsunit/es6/array-iterator-detached.js
new file mode 100644
index 0000000000000000000000000000000000000000..1d239c55caf5ce49cd9f5d7a473c08565134dda1
--- /dev/null
+++ b/test/mjsunit/es6/array-iterator-detached.js
@@ -0,0 +1,50 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// See Runtime_GetOptimizationStatus in runtime-test.cc
+const kInterpreted = 8;
+const kNo = 2;
+
+function Baseline() {
+  let array = new Uint8Array([0, 1, 2, 3, 4, 5, 6, 7, 8, 9]);
+
+  let it = array[Symbol.iterator]();
+  assertEquals(0, it.next().value);
+  assertEquals(1, it.next().value);
+  assertEquals(2, it.next().value);
+  %ArrayBufferNeuter(array.buffer);
+  it.next();
+};
+%NeverOptimizeFunction(Baseline);
+
+assertThrows(Baseline, TypeError,
+    "Cannot perform Array Iterator.prototype.next on a detached ArrayBuffer");
+
+function Turbo() {
+  let array = Array(5000);
+  for (let i = 0; i < 5000; ++i) {
+    array[i] = 254;
+  }
+  array[3000] = 255;
+  array = new Uint8Array(array);
+
+  let sum = 0;
+  let it = array[Symbol.iterator]();
+  for (let i = 0; i < 5000; ++i) {
+    let result = it.next();
+    if (result.value === 255) {
+      let state = %GetOptimizationStatus(Turbo);
+      assertTrue(state === kInterpreted || state === kNo,
+                 "Turbo should be optimized using TurboFan backend.");

[caitp, 2017/01/03 16:26:36]

these sorts of assertions are hard to get right :(

+      %ArrayBufferNeuter(array.buffer);
+    }
+    sum += result.value;
+  }
+  return sum;
+}
+
+assertThrows(Turbo, TypeError,
+    "Cannot perform Array Iterator.prototype.next on a detached ArrayBuffer");