Remove the weak list of views from array buffers

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <sstream>
 
 #include "src/v8.h"
 
@@ skipping 2409 matching lines @@
         HObjectAccess::ForArrayLength(elements_kind));
   } else {
     length = AddLoadFixedArrayLength(elements);
   }
   length->set_type(HType::Smi());
   HValue* checked_key = NULL;
   if (IsExternalArrayElementsKind(elements_kind) ||
       IsFixedTypedArrayElementsKind(elements_kind)) {
     HValue* backing_store;
     if (IsExternalArrayElementsKind(elements_kind)) {
+      NoObservableSideEffectsScope no_effects(this);
+      HInstruction* buffer = Add<HLoadNamedField>(
+          checked_object, nullptr, HObjectAccess::ForJSArrayBufferViewBuffer());
+      HInstruction* flags = Add<HLoadNamedField>(
+          buffer, nullptr, HObjectAccess::ForJSArrayBufferFlag());
+      HValue* was_neutered_mask =
+          Add<HConstant>(1 << JSArrayBuffer::kWasNeuteredBit);
+      HValue* was_neutered_test =
+          AddUncasted<HBitwise>(Token::BIT_AND, flags, was_neutered_mask);
+
+      IfBuilder if_was_neutered(this);
+      if_was_neutered.If<HCompareNumericAndBranch>(
+          was_neutered_test, graph()->GetConstant0(), Token::NE);
+      if_was_neutered.ThenDeopt(Deoptimizer::kOutOfBounds);
+      if_was_neutered.End();
+
       backing_store = Add<HLoadNamedField>(
           elements, nullptr, HObjectAccess::ForExternalArrayExternalPointer());
     } else {
       backing_store = elements;
     }
     if (store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
       NoObservableSideEffectsScope no_effects(this);
       IfBuilder length_checker(this);
       length_checker.If<HCompareNumericAndBranch>(key, length, Token::LT);
       length_checker.Then();
@@ skipping 7146 matching lines @@
       byte_offset);
   Add<HStoreNamedField>(
       obj,
       HObjectAccess::ForJSArrayBufferViewByteLength(),
       byte_length);
 
   if (buffer != NULL) {
     Add<HStoreNamedField>(
         obj,
         HObjectAccess::ForJSArrayBufferViewBuffer(), buffer);
-    HObjectAccess weak_first_view_access =
-        HObjectAccess::ForJSArrayBufferWeakFirstView();
-    Add<HStoreNamedField>(
-        obj, HObjectAccess::ForJSArrayBufferViewWeakNext(),
-        Add<HLoadNamedField>(buffer, nullptr, weak_first_view_access));
-    Add<HStoreNamedField>(buffer, weak_first_view_access, obj);
   } else {
     Add<HStoreNamedField>(
         obj,
         HObjectAccess::ForJSArrayBufferViewBuffer(),
         Add<HConstant>(static_cast<int32_t>(0)));
-    Add<HStoreNamedField>(obj,
-        HObjectAccess::ForJSArrayBufferViewWeakNext(),
-        graph()->GetConstantUndefined());
   }
 }
 
 
 void HOptimizedGraphBuilder::GenerateDataViewInitialize(
     CallRuntime* expr) {
   ZoneList<Expression*>* arguments = expr->arguments();
 
   DCHECK(arguments->length()== 4);
   CHECK_ALIVE(VisitForValue(arguments->at(0)));
@@ skipping 273 matching lines @@
     CallRuntime* expr) {
   DCHECK(expr->arguments()->length() == 1);
   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
   HValue* buffer = Pop();
   HInstruction* result = New<HLoadNamedField>(
       buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
   return ast_context()->ReturnInstruction(result, expr->id());
 }
 
 
+void HOptimizedGraphBuilder::GenerateArrayBufferViewIndirectAccessor(
+    CallRuntime* expr, HObjectAccess access) {
+  NoObservableSideEffectsScope scope(this);
+  DCHECK(expr->arguments()->length() == 1);
+  CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
+  HValue* view = Pop();
+  HInstruction* buffer = Add<HLoadNamedField>(
+      view, nullptr, HObjectAccess::ForJSArrayBufferViewBuffer());
+  HInstruction* field = Add<HLoadNamedField>(view, nullptr, access);
+
+  IfBuilder if_has_buffer(this);
+  if_has_buffer.IfNot<HIsSmiAndBranch>(buffer);
+  if_has_buffer.Then();
+  {
+    HInstruction* flags = Add<HLoadNamedField>(
+        buffer, nullptr, HObjectAccess::ForJSArrayBufferFlag());
+    HValue* was_neutered_mask =
+        Add<HConstant>(1 << JSArrayBuffer::kWasNeuteredBit);
+    HValue* was_neutered_test =

[Toon Verwaest, 2015/04/17 13:25:55]

For now this is fine by me, but we should at least get data on the alternative
approach that only has a single branch by folding it into the boundscheck.

+        AddUncasted<HBitwise>(Token::BIT_AND, flags, was_neutered_mask);
+
+    IfBuilder if_was_neutered(this);
+    if_was_neutered.If<HCompareNumericAndBranch>(
+        was_neutered_test, graph()->GetConstant0(), Token::NE);
+    if_was_neutered.Then();
+    Push(graph()->GetConstant0());
+    if_was_neutered.Else();
+    Push(field);
+    if_was_neutered.End();
+  }
+  if_has_buffer.Else();
+  Push(field);
+  if_has_buffer.End();
+
+  return ast_context()->ReturnValue(Pop());
+}
+
+
 void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteLength(
     CallRuntime* expr) {
-  DCHECK(expr->arguments()->length() == 1);
-  CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
-  HValue* buffer = Pop();
-  HInstruction* result = New<HLoadNamedField>(
-      buffer, nullptr, HObjectAccess::ForJSArrayBufferViewByteLength());
-  return ast_context()->ReturnInstruction(result, expr->id());
+  return GenerateArrayBufferViewIndirectAccessor(
+      expr, HObjectAccess::ForJSArrayBufferViewByteLength());
 }
 
 
 void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteOffset(
     CallRuntime* expr) {
-  DCHECK(expr->arguments()->length() == 1);
-  CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
-  HValue* buffer = Pop();
-  HInstruction* result = New<HLoadNamedField>(
-      buffer, nullptr, HObjectAccess::ForJSArrayBufferViewByteOffset());
-  return ast_context()->ReturnInstruction(result, expr->id());
+  return GenerateArrayBufferViewIndirectAccessor(
+      expr, HObjectAccess::ForJSArrayBufferViewByteOffset());
 }
 
 
 void HOptimizedGraphBuilder::GenerateTypedArrayGetLength(
     CallRuntime* expr) {
-  DCHECK(expr->arguments()->length() == 1);
-  CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
-  HValue* buffer = Pop();
-  HInstruction* result = New<HLoadNamedField>(
-      buffer, nullptr, HObjectAccess::ForJSTypedArrayLength());
-  return ast_context()->ReturnInstruction(result, expr->id());
+  return GenerateArrayBufferViewIndirectAccessor(
+      expr, HObjectAccess::ForJSTypedArrayLength());
 }
 
 
 void HOptimizedGraphBuilder::VisitCallRuntime(CallRuntime* expr) {
   DCHECK(!HasStackOverflow());
   DCHECK(current_block() != NULL);
   DCHECK(current_block()->HasPredecessor());
   if (expr->is_jsruntime()) {
     return Bailout(kCallToAJavaScriptRuntimeFunction);
   }
@@ skipping 3018 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal