[typedarrays] Check detached buffer at start of typed array methods

test/mjsunit/regress/regress-4665.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // First test case
 
 function FirstBuffer () {}
 FirstBuffer.prototype.__proto__ = Uint8Array.prototype
 FirstBuffer.__proto__ = Uint8Array
 
 var buf = new Uint8Array(10)
 buf.__proto__ = FirstBuffer.prototype
 
-var buf2 = buf.subarray(2)
-assertEquals(8, buf2.length);
+assertThrows(() => buf.subarray(2), TypeError);
 
 // Second test case
 

[Camillo Bruni, 2017/04/03 08:18:14]

Would you mind extending this test a bit to make it clearer?

let seen_args = [];

[Choongwoo Han, 2017/04/03 08:42:29]

Done.

 function SecondBuffer (arg) {

[Camillo Bruni, 2017/04/03 08:18:14]

seen_args.push(arg);

[Choongwoo Han, 2017/04/03 08:42:29]

Done.

   var arr = new Uint8Array(arg)
   arr.__proto__ = SecondBuffer.prototype
   return arr
 }
 SecondBuffer.prototype.__proto__ = Uint8Array.prototype
 SecondBuffer.__proto__ = Uint8Array
 
 var buf3 = new SecondBuffer(10)

[Camillo Bruni, 2017/04/03 08:18:14]

assertEquals([10], seen_args);

[Choongwoo Han, 2017/04/03 08:42:29]

Done.

 
 var buf4 = buf3.subarray(2)
 
-assertEquals(8, buf4.length);
+assertEquals(10, buf4.length);

[Camillo Bruni, 2017/04/03 08:18:14]

assertEquals([10, buf3.buffer], seen_args);

[Choongwoo Han, 2017/04/03 08:42:29]

Done.