Check whether a typed array was neutered before writing to it

As demanded by the spec.

BUG=chromium:516251
R=jkummerow@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1261453004

Cr-Commit-Position: refs/heads/master@{#29981}

diff --git a/src/objects.cc b/src/objects.cc
index 1a0a368..8aa73d6 100644 (file)
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3426,6 +3426,12 @@ MaybeHandle<Object> Object::SetDataProperty(LookupIterator* it,
       // have been invalidated since typed array elements cannot be reconfigured
       // in any way.
       it->ReloadHolderMap();
+
+      // We have to recheck the length. However, it can only change if the
+      // underlying buffer was neutered, so just check that.
+      if (Handle<JSArrayBufferView>::cast(receiver)->WasNeutered()) {
+        return value;
+      }
     }
   }