[typedarrays] Check detached buffer at start of typed array methods

test/mjsunit/es6/typedarray-iteration.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Tests for standard TypedArray array iteration functions.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
   Uint16Array,
   Int16Array,
   Uint32Array,
   Int32Array,
   Uint8ClampedArray,
   Float32Array,
   Float64Array
@@ skipping 53 matching lines @@
     assertThrows(function() {
       constructor.prototype.filter.call([], function() {});
     }, TypeError);
 
     // Shadowing the length property doesn't change anything
     a = new constructor([1, 2]);
     Object.defineProperty(a, 'length', { value: 1 });
     assertArrayLikeEquals([2], a.filter(function(elt) {
       return elt == 2;
     }), constructor);
+
+    // Detached Operation
+    var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+    %ArrayBufferNeuter(array.buffer);
+    assertThrows(() => array.filter(() => false), TypeError);
   })();
 
   (function TypedArrayMapTest() {
     var a = new constructor([0, 1, 2, 3, 4]);
 
     // Simple use.
     var result = [1, 2, 3, 4, 5];
     assertArrayLikeEquals(result, a.map(function(n) { return n + 1; }),
                           constructor);
     assertEquals(a, a);
@@ skipping 33 matching lines @@
 
     // Test that the result is converted to the right type
     assertArrayLikeEquals([3, 3], new constructor([1, 2]).map(function() {
       return "3";
     }), constructor);
     if (constructor !== Float32Array && constructor !== Float64Array) {
       assertArrayLikeEquals([0, 0], new constructor([1, 2]).map(function() {
         return NaN;
       }), constructor);
     }
+
+    // Detached Operation
+    var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+    %ArrayBufferNeuter(array.buffer);
+    assertThrows(() => array.map((v) => v), TypeError);
   })();
 
   //
   // %TypedArray%.prototype.some
   //
   (function TypedArraySomeTest() {
     var a = new constructor([0, 1, 2, 3, 4]);
 
     // Simple use.
     assertTrue(a.some(function(n) { return n == 3}));
@@ skipping 39 matching lines @@
       constructor.prototype.some.call([], function() {});
     }, TypeError);
 
     // Shadowing the length property doesn't change anything
     a = new constructor([1, 2]);
     Object.defineProperty(a, 'length', { value: 1 });
     assertEquals(true, a.some(function(elt) { return elt == 2; }));
     assertEquals(false, Array.prototype.some.call(a, function(elt) {
       return elt == 2;
     }));
+
+    // Detached Operation
+    var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+    %ArrayBufferNeuter(array.buffer);
+    assertThrows(() => array.some((v) => false), TypeError);
   })();
 
 }