1 files changed, 38 insertions, 0 deletions
diff --git a/js/src/tests/test262/built-ins/DataView/prototype/getInt8/detached-buffer-after-toindex-byteoffset.js b/js/src/tests/test262/built-ins/DataView/prototype/getInt8/detached-buffer-after-toindex-byteoffset.js
new file mode 100644
index 0000000000..531aa7c483
--- /dev/null
+++ b/js/src/tests/test262/built-ins/DataView/prototype/getInt8/detached-buffer-after-toindex-byteoffset.js
@@ -0,0 +1,38 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-dataview.prototype.getint8
+description: >
+  Detached buffer is only checked after ToIndex(requestIndex)
+info: |
+  24.2.4.7 DataView.prototype.getInt8 ( byteOffset )
+
+  1. Let v be the this value.
+  2. Return ? GetViewValue(v, byteOffset, true, "Int8").
+
+  24.2.1.1 GetViewValue ( view, requestIndex, isLittleEndian, type )
+
+  ...
+  4. Let getIndex be ? ToIndex(requestIndex).
+  ...
+  6. Let buffer be view.[[ViewedArrayBuffer]].
+  7. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+  ...
+includes: [detachArrayBuffer.js]
+---*/
+
+var buffer = new ArrayBuffer(8);
+var sample = new DataView(buffer, 0);
+
+$DETACHBUFFER(buffer);
+
+assert.throws(RangeError, function() {
+  sample.getInt8(Infinity);
+}, "Infinity");
+
+assert.throws(RangeError, function() {
+  sample.getInt8(-1);
+});
+
+reportCompare(0, 0);