[typedarrays] Check detached buffer at start of typed array methods

test/mjsunit/es6/typedarray-findindex.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
   Uint16Array,
   Int16Array,
   Uint32Array,
   Int32Array,
   Uint8ClampedArray,
   Float32Array,
   Float64Array];
@@ skipping 162 matching lines @@
 // Shadowing length doesn't affect findIndex, unlike Array.prototype.findIndex
 a = new constructor([1, 2]);
 Object.defineProperty(a, 'length', {value: 1});
 var x = 0;
 assertEquals(a.findIndex(function(elt) { x += elt; return false; }), -1);
 assertEquals(x, 3);
 assertEquals(Array.prototype.findIndex.call(a,
     function(elt) { x += elt; return false; }), -1);
 assertEquals(x, 4);
 
+// Detached Operation
+  var tmp = {
+    [Symbol.toPrimitive]() {
+      assertUnreachable("Parameter should not be processed when " +
+                        "array.[[ViewedArrayBuffer]] is neutered.");
+      return 0;
+    }
+  };
+
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+
+  assertThrows(() => array.findIndex(tmp), TypeError);
 }