[typedarrays] Check detached buffer at start of typed array methods

src/objects-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // Review notes:
 //
 // - The use of macros in these inline functions may seem superfluous
 // but it is absolutely needed to make sure gcc generates optimal
 // code. gcc is not happy when attempting to inline too deep.
 //
@@ skipping 6879 matching lines @@
 
 // static
 MaybeHandle<JSTypedArray> JSTypedArray::Validate(Isolate* isolate,
                                                  Handle<Object> receiver,
                                                  const char* method_name) {
   if (V8_UNLIKELY(!receiver->IsJSTypedArray())) {
     const MessageTemplate::Template message = MessageTemplate::kNotTypedArray;
     THROW_NEW_ERROR(isolate, NewTypeError(message), JSTypedArray);
   }
 
-  // TODO(caitp): throw if array.[[ViewedArrayBuffer]] is neutered (per v8:4648)
-  return Handle<JSTypedArray>::cast(receiver);
+  Handle<JSTypedArray> array = Handle<JSTypedArray>::cast(receiver);
+  if (V8_UNLIKELY(array->WasNeutered())) {
+    const MessageTemplate::Template message =
+        MessageTemplate::kDetachedOperation;
+    Handle<String> operation =
+        isolate->factory()->NewStringFromAsciiChecked(method_name);
+    THROW_NEW_ERROR(isolate, NewTypeError(message, operation), JSTypedArray);
+  }
+
+  // TODO(cwhan.tunz): spec describes to return `buffer`, but it may disrupt
+  // current implementations, and it's much useful to return array for now.

[Dan Ehrenberg, 2017/03/28 19:39:28]

Nit: I agree with your reasoning here; I think you can remove
"TODO(cwhan.tunz):" and just have this comment.

[Choongwoo Han, 2017/03/29 05:36:54]

Done.

+  return array;
 }
 
 #ifdef VERIFY_HEAP
 ACCESSORS(JSTypedArray, raw_length, Object, kLengthOffset)
 #endif
 
 ACCESSORS(JSPromiseCapability, promise, Object, kPromiseOffset)
 ACCESSORS(JSPromiseCapability, resolve, Object, kResolveOffset)
 ACCESSORS(JSPromiseCapability, reject, Object, kRejectOffset)
 
@@ skipping 1327 matching lines @@
 #undef WRITE_BYTE_FIELD
 #undef NOBARRIER_READ_BYTE_FIELD
 #undef NOBARRIER_WRITE_BYTE_FIELD
 
 }  // namespace internal
 }  // namespace v8
 
 #include "src/objects/object-macros-undef.h"
 
 #endif  // V8_OBJECTS_INL_H_