diff --git a/lib/VM/JSLib/TypedArray.cpp b/lib/VM/JSLib/TypedArray.cpp index 6aece6b4d95..bbb26b9cb9f 100644 --- a/lib/VM/JSLib/TypedArray.cpp +++ b/lib/VM/JSLib/TypedArray.cpp @@ -1012,6 +1012,11 @@ typedArrayPrototypeIndexOf(void *ctx, Runtime *runtime, NativeArgs args) { return ExecutionStatus::EXCEPTION; } fromIndex = res->getNumber(); + if (LLVM_UNLIKELY(!self->attached(runtime))) { + // If the ToInteger call detached this TypedArray, raise a TypeError and + // don't continue. + return runtime->raiseTypeError("Detached the TypedArray in the callback"); + } } // Negative zero case. if (fromIndex == 0) { diff --git a/test/hermes/TypedArray.js b/test/hermes/TypedArray.js index 65522c327fb..34673ea9b2d 100644 --- a/test/hermes/TypedArray.js +++ b/test/hermes/TypedArray.js @@ -848,6 +848,15 @@ cons.forEach(function(TypedArray) { arr[1] = 50; assert.equal(arr.indexOf(50), 0); assert.equal(arr.lastIndexOf(50), 1); + + assert.throws(function() { + arr.includes(0, { + valueOf() { + HermesInternal.detachArrayBuffer(arr.buffer); + return 0; + }, + }); + }, TypeError); }); /// @}