[typedarrays] Check detached buffer at start of typed array methods

test/mjsunit/es6/typedarray-indexing.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
   Uint16Array,
   Int16Array,
   Uint32Array,
   Int32Array,
   Uint8ClampedArray,
   Float32Array,
   Float64Array
 ];
 
+var tmp = {
+  [Symbol.toPrimitive]() {
+    assertUnreachable("Parameter should not be processed when " +
+                      "array.[[ViewedArrayBuffer]] is neutered.");
+    return 0;
+  }
+};
+
 for (var constructor of typedArrayConstructors) {
   var array = new constructor([1, 2, 3, 1, 2, 3, 1, 2, 3, 1, 2, 3]);
 
   // ----------------------------------------------------------------------
   // %TypedArray%.prototype.indexOf.
   // ----------------------------------------------------------------------
 
   // Negative cases.
   assertEquals(-1, new constructor([]).indexOf(1));
   assertEquals(-1, array.indexOf(4));
@@ skipping 19 matching lines @@
   array = new constructor([NaN, 2, 3, +Infinity, -Infinity, 5, 6]);
   if (constructor == Float32Array || constructor == Float64Array) {
     assertEquals(3, array.indexOf(Infinity));
     assertEquals(4, array.indexOf(-Infinity));
   } else {
     assertEquals(-1, array.indexOf(Infinity));
     assertEquals(-1, array.indexOf(-Infinity));
   }
   assertEquals(-1, array.indexOf(NaN));
 
+  // Detached Operation
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+
+  assertThrows(() => array.indexOf(tmp), TypeError);
+
   // ----------------------------------------------------------------------
   // %TypedArray%.prototype.lastIndexOf.
   // ----------------------------------------------------------------------
   array = new constructor([1, 2, 3, 1, 2, 3, 1, 2, 3, 1, 2, 3]);
 
   // Negative cases.
   assertEquals(-1, new constructor([]).lastIndexOf(1));
   assertEquals(-1, array.lastIndexOf(1, -17));
 
   assertEquals(9, array.lastIndexOf(1));
@@ skipping 16 matching lines @@
   // Index of infinite value
   array = new constructor([NaN, 2, 3, +Infinity, -Infinity, 5, 6]);
   if (constructor == Float32Array || constructor == Float64Array) {
     assertEquals(3, array.lastIndexOf(Infinity));
     assertEquals(4, array.lastIndexOf(-Infinity));
   } else {
     assertEquals(-1, array.lastIndexOf(Infinity));
     assertEquals(-1, array.lastIndexOf(-Infinity));
   }
   assertEquals(-1, array.lastIndexOf(NaN));
+
+  // Detached Operation
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+  assertThrows(() => array.lastIndexOf(tmp), TypeError);
 }