Add HArrayBufferNotNeutered instruction

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <sstream>
 
 #include "src/v8.h"
 
@@ skipping 2407 matching lines @@
     length = Add<HLoadNamedField>(
         checked_object->ActualValue(), checked_object,
         HObjectAccess::ForArrayLength(elements_kind));
   } else {
     length = AddLoadFixedArrayLength(elements);
   }
   length->set_type(HType::Smi());
   HValue* checked_key = NULL;
   if (IsExternalArrayElementsKind(elements_kind) ||
       IsFixedTypedArrayElementsKind(elements_kind)) {
+    checked_object = Add<HCheckArrayBufferNotNeutered>(checked_object);
+
     HValue* backing_store;
     if (IsExternalArrayElementsKind(elements_kind)) {
       backing_store = Add<HLoadNamedField>(
           elements, nullptr, HObjectAccess::ForExternalArrayExternalPointer());
     } else {
       backing_store = elements;
     }
     if (store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
       NoObservableSideEffectsScope no_effects(this);
-      if (IsExternalArrayElementsKind(elements_kind)) {
-        HInstruction* buffer =
-            Add<HLoadNamedField>(checked_object, nullptr,
-                                 HObjectAccess::ForJSArrayBufferViewBuffer());
-        HInstruction* flags = Add<HLoadNamedField>(
-            buffer, nullptr, HObjectAccess::ForJSArrayBufferBitField());
-        HValue* was_neutered_mask =
-            Add<HConstant>(1 << JSArrayBuffer::WasNeutered::kShift);
-        HValue* was_neutered_test =
-            AddUncasted<HBitwise>(Token::BIT_AND, flags, was_neutered_mask);
-
-        IfBuilder if_was_neutered(this);
-        if_was_neutered.If<HCompareNumericAndBranch>(
-            was_neutered_test, graph()->GetConstant0(), Token::NE);
-        if_was_neutered.ThenDeopt(Deoptimizer::kOutOfBounds);
-        if_was_neutered.End();
-      }
       IfBuilder length_checker(this);
       length_checker.If<HCompareNumericAndBranch>(key, length, Token::LT);
       length_checker.Then();
       IfBuilder negative_checker(this);
       HValue* bounds_check = negative_checker.If<HCompareNumericAndBranch>(
           key, graph()->GetConstant0(), Token::GTE);
       negative_checker.Then();
       HInstruction* result = AddElementAccess(
           backing_store, key, val, bounds_check, elements_kind, access_type);
       negative_checker.ElseDeopt(Deoptimizer::kNegativeKeyEncountered);
       negative_checker.End();
       length_checker.End();
       return result;
     } else {
-      if (IsExternalArrayElementsKind(elements_kind)) {
-        HInstruction* buffer =
-            Add<HLoadNamedField>(checked_object, nullptr,
-                                 HObjectAccess::ForJSArrayBufferViewBuffer());
-        HInstruction* buffer_length = Add<HLoadNamedField>(
-            buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
-        Add<HBoundsCheck>(graph()->GetConstant0(), buffer_length);
-      }
       DCHECK(store_mode == STANDARD_STORE);
       checked_key = Add<HBoundsCheck>(key, length);
       return AddElementAccess(
           backing_store, checked_key, val,
           checked_object, elements_kind, access_type);
     }
   }
   DCHECK(fast_smi_only_elements ||
          fast_elements ||
          IsFastDoubleElementsKind(elements_kind));
@@ skipping 3847 matching lines @@
     HValue* value, BailoutId ast_id, BailoutId return_id,
     bool can_inline_accessor) {
   HObjectAccess access = HObjectAccess::ForMap();  // bogus default
   if (info->GetJSObjectFieldAccess(&access)) {
     DCHECK(info->IsLoad());
     return New<HLoadNamedField>(object, checked_object, access);
   }
 
   if (info->GetJSArrayBufferViewFieldAccess(&access)) {
     DCHECK(info->IsLoad());
-    return BuildArrayBufferViewFieldAccessor(
-        object, checked_object, FieldIndex::ForInObjectOffset(access.offset()));
+    checked_object = Add<HCheckArrayBufferNotNeutered>(checked_object);
+    return New<HLoadNamedField>(object, checked_object, access);
   }
 
   if (info->name().is_identical_to(isolate()->factory()->prototype_string()) &&
       info->map()->function_with_prototype()) {
     DCHECK(!info->map()->has_non_instance_prototype());
     return New<HLoadFunctionPrototype>(checked_object);
   }
 
   HValue* checked_holder = checked_object;
   if (info->has_holder()) {
@@ skipping 6774 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal