Make it possible to hoist the neutering check for TA property accesses

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <sstream>
 
 #include "src/v8.h"
 
@@ skipping 2447 matching lines @@
       HValue* bounds_check = negative_checker.If<HCompareNumericAndBranch>(
           key, graph()->GetConstant0(), Token::GTE);
       negative_checker.Then();
       HInstruction* result = AddElementAccess(
           backing_store, key, val, bounds_check, elements_kind, access_type);
       negative_checker.ElseDeopt(Deoptimizer::kNegativeKeyEncountered);
       negative_checker.End();
       length_checker.End();
       return result;
     } else {
+      HValue* neuter_checked_object = checked_object;
       if (IsExternalArrayElementsKind(elements_kind)) {
         HInstruction* buffer =
             Add<HLoadNamedField>(checked_object, nullptr,
                                  HObjectAccess::ForJSArrayBufferViewBuffer());
         HInstruction* buffer_length = Add<HLoadNamedField>(
             buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
-        Add<HBoundsCheck>(graph()->GetConstant0(), buffer_length);
+        neuter_checked_object =
+            Add<HBoundsCheck>(graph()->GetConstant0(), buffer_length);
       }
       DCHECK(store_mode == STANDARD_STORE);
       checked_key = Add<HBoundsCheck>(key, length);
-      return AddElementAccess(
-          backing_store, checked_key, val,
-          checked_object, elements_kind, access_type);
+      return AddElementAccess(backing_store, checked_key, val,
+                              neuter_checked_object, elements_kind,
+                              access_type);
     }
   }
   DCHECK(fast_smi_only_elements ||
          fast_elements ||
          IsFastDoubleElementsKind(elements_kind));
 
   // In case val is stored into a fast smi array, assure that the value is a smi
   // before manipulating the backing store. Otherwise the actual store may
   // deopt, leaving the backing store in an invalid state.
   if (access_type == STORE && IsFastSmiElementsKind(elements_kind) &&
@@ skipping 3812 matching lines @@
     HValue* value, BailoutId ast_id, BailoutId return_id,
     bool can_inline_accessor) {
   HObjectAccess access = HObjectAccess::ForMap();  // bogus default
   if (info->GetJSObjectFieldAccess(&access)) {
     DCHECK(info->IsLoad());
     return New<HLoadNamedField>(object, checked_object, access);
   }
 
   if (info->GetJSArrayBufferViewFieldAccess(&access)) {
     DCHECK(info->IsLoad());
-    return BuildArrayBufferViewFieldAccessor(
-        object, checked_object, FieldIndex::ForInObjectOffset(access.offset()));
+    HValue* neuter_checked_object = checked_object;
+    if (IsExternalArrayElementsKind(info->map()->elements_kind())) {
+      HInstruction* buffer = Add<HLoadNamedField>(
+          checked_object, nullptr, HObjectAccess::ForJSArrayBufferViewBuffer());
+      HInstruction* buffer_length = Add<HLoadNamedField>(
+          buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
+      neuter_checked_object =
+          Add<HBoundsCheck>(graph()->GetConstant0(), buffer_length);
+    }
+    return New<HLoadNamedField>(object, neuter_checked_object, access);
   }
 
   if (info->name().is_identical_to(isolate()->factory()->prototype_string()) &&
       info->map()->function_with_prototype()) {
     DCHECK(!info->map()->has_non_instance_prototype());
     return New<HLoadFunctionPrototype>(checked_object);
   }
 
   HValue* checked_holder = checked_object;
   if (info->has_holder()) {
@@ skipping 6756 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal