Detect detached TypedArray in indexOf.

Summary:
`includes` et al. can detach a TypedArray in the `ToInteger` call
for the argument.
Check for this.

Reviewed By: dulinriley

Differential Revision: D22344490

fbshipit-source-id: 4f37735859bca8882226b9da8876154d66a09888

lib/VM/JSLib/TypedArray.cpp

@@ -1012,6 +1012,11 @@ typedArrayPrototypeIndexOf(void *ctx, Runtime *runtime, NativeArgs args) {
       return ExecutionStatus::EXCEPTION;
     }
     fromIndex = res->getNumber();
+    if (LLVM_UNLIKELY(!self->attached(runtime))) {
+      // If the ToInteger call detached this TypedArray, raise a TypeError and
+      // don't continue.
+      return runtime->raiseTypeError("Detached the TypedArray in the callback");
+    }
   }
   // Negative zero case.
   if (fromIndex == 0) {

test/hermes/TypedArray.js

@@ -848,6 +848,15 @@ cons.forEach(function(TypedArray) {
   arr[1] = 50;
   assert.equal(arr.indexOf(50), 0);
   assert.equal(arr.lastIndexOf(50), 1);
+
+  assert.throws(function() {
+    arr.includes(0, {
+      valueOf() {
+        HermesInternal.detachArrayBuffer(arr.buffer);
+        return 0;
+      },
+    });
+  }, TypeError);
 });
 /// @}