Reland [typedarrays] Check detached buffer at start of typed array methods

test/mjsunit/es6/typedarray-fill.js

Index: test/mjsunit/es6/typedarray-fill.js
diff --git a/test/mjsunit/es6/typedarray-fill.js b/test/mjsunit/es6/typedarray-fill.js
index 260e5ab08a4982d55a5a0522e2e74412506ae6ea..9ed220373bedda1255b935fb513abed9e325bc82 100644
--- a/test/mjsunit/es6/typedarray-fill.js
+++ b/test/mjsunit/es6/typedarray-fill.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var intArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -67,6 +69,18 @@ for (var constructor of typedArrayConstructors) {
   assertArrayEquals([3, 3], [a[0], a[1]]);
   Array.prototype.fill.call(a, 4);
   assertArrayEquals([4, 3], [a[0], a[1]]);
+
+  // Detached Operation
+  var tmp = {
+    [Symbol.toPrimitive]() {
+      assertUnreachable("Parameter should not be processed when " +
+                        "array.[[ViewedArrayBuffer]] is neutered.");
+      return 0;
+    }
+  };
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+  assertThrows(() => array.fill(tmp), TypeError);
 }
 
 for (var constructor of intArrayConstructors) {