[typedarrays] Check detached buffer at start of typed array methods

test/mjsunit/es6/typedarray-tostring.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Array's toString should call the object's own join method, if one exists and
 // is callable. Otherwise, just use the original Object.toString function.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
   Uint16Array,
   Int16Array,
   Uint32Array,
   Int32Array,
   Uint8ClampedArray,
   Float32Array,
   Float64Array
@@ skipping 71 matching lines @@
     let pushArgs = (label) => (...args) => log.push(label, args);
 
     let NumberToLocaleString = Number.prototype.toLocaleString;
     Number.prototype.toLocaleString = pushArgs("Number");
 
     (new constructor([1, 2])).toLocaleString();
     assertEquals(["Number", [], "Number", []], log);
 
     Number.prototype.toLocaleString = NumberToLocaleString;
   })();
+
+  // Detached Operation
+  var array = new constructor([1, 2, 3]);
+  %ArrayBufferNeuter(array.buffer);
+  assertThrows(() => array.join(), TypeError);
+  assertThrows(() => array.toLocalString(), TypeError);
+  assertThrows(() => array.toString(), TypeError);
 }