[turbofan] Add support for special JSArrayBufferView accessors.

src/compiler/access-info.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <ostream>
 
 #include "src/accessors.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-info.h"
 #include "src/field-index-inl.h"
@@ skipping 57 matching lines @@
 PropertyAccessInfo PropertyAccessInfo::DataConstant(
     Type* receiver_type, Handle<Object> constant,
     MaybeHandle<JSObject> holder) {
   return PropertyAccessInfo(holder, constant, receiver_type);
 }
 
 
 // static
 PropertyAccessInfo PropertyAccessInfo::DataField(
     Type* receiver_type, FieldIndex field_index, Type* field_type,
-    MaybeHandle<JSObject> holder, MaybeHandle<Map> transition_map) {
-  return PropertyAccessInfo(holder, transition_map, field_index, field_type,
-                            receiver_type);
+    FieldCheck field_check, MaybeHandle<JSObject> holder,
+    MaybeHandle<Map> transition_map) {
+  return PropertyAccessInfo(holder, transition_map, field_index, field_check,
+                            field_type, receiver_type);
 }
 
 
 ElementAccessInfo::ElementAccessInfo() : receiver_type_(Type::None()) {}
 
 
 ElementAccessInfo::ElementAccessInfo(Type* receiver_type,
                                      ElementsKind elements_kind,
                                      MaybeHandle<JSObject> holder)
     : elements_kind_(elements_kind),
@@ skipping 18 matching lines @@
                                        Type* receiver_type)
     : kind_(kDataConstant),
       receiver_type_(receiver_type),
       constant_(constant),
       holder_(holder),
       field_type_(Type::Any()) {}
 
 
 PropertyAccessInfo::PropertyAccessInfo(MaybeHandle<JSObject> holder,
                                        MaybeHandle<Map> transition_map,
-                                       FieldIndex field_index, Type* field_type,
+                                       FieldIndex field_index,
+                                       FieldCheck field_check, Type* field_type,
                                        Type* receiver_type)
     : kind_(kDataField),
       receiver_type_(receiver_type),
       transition_map_(transition_map),
       holder_(holder),
       field_index_(field_index),
+      field_check_(field_check),
       field_type_(field_type) {}
 
 
 AccessInfoFactory::AccessInfoFactory(CompilationDependencies* dependencies,
                                      Handle<Context> native_context, Zone* zone)
     : dependencies_(dependencies),
       native_context_(native_context),
       isolate_(native_context->GetIsolate()),
       type_cache_(TypeCache::Get()),
       zone_(zone) {}
@@ skipping 143 matching lines @@
             // runtime/GC interaction.
             field_type = Type::TaggedPointer();
           } else if (!Type::Any()->Is(field_type)) {
             // Add proper code dependencies in case of stable field map(s).
             Handle<Map> field_owner_map(map->FindFieldOwner(number), isolate());
             dependencies()->AssumeFieldType(field_owner_map);
           }
           DCHECK(field_type->Is(Type::TaggedPointer()));
         }
         *access_info = PropertyAccessInfo::DataField(
-            Type::Class(receiver_map, zone()), field_index, field_type, holder);
+            Type::Class(receiver_map, zone()), field_index, field_type,
+            FieldCheck::kNone, holder);
         return true;
       } else {
         // TODO(bmeurer): Add support for accessors.
         return false;
       }
     }
 
     // Don't search on the prototype chain for special indices in case of
     // integer indexed exotic objects (see ES6 section 9.4.5).
     if (map->IsJSTypedArrayMap() && name->IsString() &&
@@ skipping 83 matching lines @@
       } else if (IsFastElementsKind(map->elements_kind())) {
         field_type = type_cache_.kFixedArrayLengthType;
       } else {
         field_type = type_cache_.kJSArrayLengthType;
       }
     }
     *access_info = PropertyAccessInfo::DataField(Type::Class(map, zone()),
                                                  field_index, field_type);
     return true;
   }
+  // Check for special JSArrayBufferView field accessors.
+  if (Accessors::IsJSArrayBufferViewFieldAccessor(map, name, &offset)) {
+    FieldIndex field_index = FieldIndex::ForInObjectOffset(offset);
+    Type* field_type = Type::Tagged();
+    if (Name::Equals(factory()->byte_length_string(), name) ||
+        Name::Equals(factory()->byte_offset_string(), name)) {
+      // The JSArrayBufferView::byte_length and JSArrayBufferView::byte_offset
+      // properties are always numbers in the range [0, kMaxSafeInteger].
+      field_type = type_cache_.kPositiveSafeInteger;
+    } else if (map->IsJSTypedArrayMap()) {
+      DCHECK(Name::Equals(factory()->length_string(), name));
+      // The JSTypedArray::length property is always a number in the range
+      // [0, kMaxSafeInteger].
+      field_type = type_cache_.kPositiveSafeInteger;
+    }
+    *access_info = PropertyAccessInfo::DataField(
+        Type::Class(map, zone()), field_index, field_type,
+        FieldCheck::kJSArrayBufferViewBufferNotNeutered);
+    return true;
+  }
   return false;
 }
 
 
 bool AccessInfoFactory::LookupTransition(Handle<Map> map, Handle<Name> name,
                                          MaybeHandle<JSObject> holder,
                                          PropertyAccessInfo* access_info) {
   // Check if the {map} has a data transition with the given {name}.
   if (map->unused_property_fields() == 0) return false;
   Handle<Map> transition_map;
@@ skipping 30 matching lines @@
         return false;
       } else if (!Type::Any()->Is(field_type)) {
         // Add proper code dependencies in case of stable field map(s).
         Handle<Map> field_owner_map(transition_map->FindFieldOwner(number),
                                     isolate());
         dependencies()->AssumeFieldType(field_owner_map);
       }
       DCHECK(field_type->Is(Type::TaggedPointer()));
     }
     dependencies()->AssumeMapNotDeprecated(transition_map);
-    *access_info =
-        PropertyAccessInfo::DataField(Type::Class(map, zone()), field_index,
-                                      field_type, holder, transition_map);
+    *access_info = PropertyAccessInfo::DataField(
+        Type::Class(map, zone()), field_index, field_type, FieldCheck::kNone,
+        holder, transition_map);
     return true;
   }
   return false;
 }
 
 
 Factory* AccessInfoFactory::factory() const { return isolate()->factory(); }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8