[builtins] throw if TypedArray buffer is detached during iteration

test/mjsunit/es6/array-iterator-detached.js

Index: test/mjsunit/es6/array-iterator-detached.js
diff --git a/test/mjsunit/es6/array-iterator-detached.js b/test/mjsunit/es6/array-iterator-detached.js
new file mode 100644
index 0000000000000000000000000000000000000000..e9a940191b300a0dc02b27df020f76a8a26f0527
--- /dev/null
+++ b/test/mjsunit/es6/array-iterator-detached.js
@@ -0,0 +1,47 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Baseline() {
+  let array = new Uint8Array([0, 1, 2, 3, 4, 5, 6, 7, 8, 9]);
+
+  let it = array[Symbol.iterator]();
+  assertEquals(0, it.next().value);
+  assertEquals(1, it.next().value);
+  assertEquals(2, it.next().value);
+  %ArrayBufferNeuter(array.buffer);
+  it.next();
+};
+%NeverOptimizeFunction(Baseline);
+
+assertThrows(Baseline, TypeError,
+    "Cannot perform Array Iterator.prototype.next on a detached ArrayBuffer");
+
+function Turbo(count = 10000) {
+  let array = Array(10000);
+  for (let i = 0; i < 10000; ++i) {
+    array[i] = 254;
+  }
+  array[5000] = 255;
+  array = new Uint8Array(array);
+
+  let sum = 0;
+  let it = array[Symbol.iterator]();
+  for (let i = 0; i < count; ++i) {
+    let result = it.next();
+    if (result.value === 255) {
+      %ArrayBufferNeuter(array.buffer);
+    }
+    sum += result.value;
+  }
+  return sum;
+}
+
+Turbo(10);
+Turbo(10);
+%OptimizeFunctionOnNextCall(Turbo);
+
+assertThrows(Turbo, TypeError,
+    "Cannot perform Array Iterator.prototype.next on a detached ArrayBuffer");