[typedarrays] Check detached buffer at start of typed array methods

src/builtins/builtins-typedarray.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-utils.h"
 #include "src/builtins/builtins.h"
 #include "src/counters.h"
 #include "src/elements.h"
 #include "src/objects-inl.h"
 
 namespace v8 {
 namespace internal {
 
 // -----------------------------------------------------------------------------
 // ES6 section 22.2 TypedArray Objects
 
 // ES6 section 22.2.3.1 get %TypedArray%.prototype.buffer
 BUILTIN(TypedArrayPrototypeBuffer) {
   HandleScope scope(isolate);
-  CHECK_RECEIVER(JSTypedArray, typed_array, "get TypedArray.prototype.buffer");
+  CHECK_RECEIVER(JSTypedArray, typed_array,
+                 "get %TypedArray%.prototype.buffer");
   return *typed_array->GetBuffer();
 }
 
 namespace {
 
 int64_t CapRelativeIndex(Handle<Object> num, int64_t minimum, int64_t maximum) {
   int64_t relative;
   if (V8_LIKELY(num->IsSmi())) {
     relative = Smi::cast(*num)->value();
   } else {
@@ skipping 13 matching lines @@
 }  // namespace
 
 BUILTIN(TypedArrayPrototypeCopyWithin) {
   HandleScope scope(isolate);
 
   Handle<JSTypedArray> array;
   const char* method = "%TypedArray%.prototype.copyWithin";
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
 
-  if (V8_UNLIKELY(array->WasNeutered())) return *array;
-
   int64_t len = array->length_value();
   int64_t to = 0;
   int64_t from = 0;
   int64_t final = len;
 
   if (V8_LIKELY(args.length() > 1)) {
     Handle<Object> num;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, num, Object::ToInteger(isolate, args.at<Object>(1)));
     to = CapRelativeIndex(num, 0, len);
@@ skipping 43 matching lines @@
 }
 
 BUILTIN(TypedArrayPrototypeFill) {
   HandleScope scope(isolate);
 
   Handle<JSTypedArray> array;
   const char* method = "%TypedArray%.prototype.fill";
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
 
-  if (V8_UNLIKELY(array->WasNeutered())) return *array;
-
   int64_t len = array->length_value();
   int64_t start = 0;
   int64_t end = len;
 
   if (args.length() > 2) {
     Handle<Object> num = args.atOrUndefined(isolate, 2);
     if (!num->IsUndefined(isolate)) {
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
           isolate, num, Object::ToInteger(isolate, num));
       start = CapRelativeIndex(num, 0, len);
@@ skipping 125 matching lines @@
 }
 
 BUILTIN(TypedArrayPrototypeReverse) {
   HandleScope scope(isolate);
 
   Handle<JSTypedArray> array;
   const char* method = "%TypedArray%.prototype.reverse";
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
 
-  if (V8_UNLIKELY(array->WasNeutered())) return *array;
-
   ElementsAccessor* elements = array->GetElementsAccessor();
   elements->Reverse(*array);
   return *array;
 }
 
 }  // namespace internal
 }  // namespace v8