Index: test/mjsunit/es6/typedarray-fill.js |
diff --git a/test/mjsunit/es6/typedarray-fill.js b/test/mjsunit/es6/typedarray-fill.js |
index 9e72f5ec896cc617371e9cde0ddddbb58b554e0d..bc31b8a69b3019581e74317e3ec3474ca695187f 100644 |
--- a/test/mjsunit/es6/typedarray-fill.js |
+++ b/test/mjsunit/es6/typedarray-fill.js |
@@ -2,6 +2,8 @@ |
// Use of this source code is governed by a BSD-style license that can be |
// found in the LICENSE file. |
+// Flags: --allow-natives-syntax |
+ |
var intArrayConstructors = [ |
Uint8Array, |
Int8Array, |
@@ -76,6 +78,19 @@ Symbol(Symbol.toStringTag) |
assertArrayEquals([3, 3], [a[0], a[1]]); |
Array.prototype.fill.call(a, 4); |
assertArrayEquals([4, 3], [a[0], a[1]]); |
+ |
+ // Detached Operation |
+ var tmp = { |
+ [Symbol.toPrimitive]() { |
+ assertUnreachable("Parameter should not be processed when " + |
+ "array.[[ViewedArrayBuffer]] is neutered."); |
+ return 0; |
+ } |
+ }; |
+ |
+ var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]); |
+ %ArrayBufferNeuter(array.buffer); |
+ assertThrows(() => array.fill(tmp), TypeError); |
} |
for (var constructor of intArrayConstructors) { |