[typedarrays] Check detached buffer at start of typed array methods

test/mjsunit/regress/regress-4665.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // First test case
 
 function FirstBuffer () {}
 FirstBuffer.prototype.__proto__ = Uint8Array.prototype
 FirstBuffer.__proto__ = Uint8Array
 
 var buf = new Uint8Array(10)
 buf.__proto__ = FirstBuffer.prototype
 
-var buf2 = buf.subarray(2)
-assertEquals(8, buf2.length);
+assertThrows(() => buf.subarray(2), TypeError);
 
 // Second test case
 
+let seen_args = [];
+
 function SecondBuffer (arg) {
+  seen_args.push(arg);
   var arr = new Uint8Array(arg)
   arr.__proto__ = SecondBuffer.prototype
   return arr
 }
 SecondBuffer.prototype.__proto__ = Uint8Array.prototype
 SecondBuffer.__proto__ = Uint8Array
 
 var buf3 = new SecondBuffer(10)
+assertEquals([10], seen_args);
 
 var buf4 = buf3.subarray(2)
 
-assertEquals(8, buf4.length);
+assertEquals(10, buf4.length);
+assertEquals([10, buf3.buffer], seen_args);