[builtins] Fix LoadObjectField for JSTypedArray::kBufferOffset

src/builtins.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins.h"
 
 #include "src/api-arguments.h"
 #include "src/api-natives.h"
 #include "src/api.h"
 #include "src/base/ieee754.h"
@@ skipping 3204 matching lines @@
   Node* receiver_instance_type = assembler->LoadInstanceType(receiver);
   assembler->GotoUnless(
       assembler->Word32Equal(receiver_instance_type,
                              assembler->Int32Constant(JS_TYPED_ARRAY_TYPE)),
       &if_receiverisincompatible);
 
   // Check if the {receiver}'s JSArrayBuffer was neutered.
   Node* receiver_buffer =
       assembler->LoadObjectField(receiver, JSTypedArray::kBufferOffset);
   Node* receiver_buffer_bit_field = assembler->LoadObjectField(
-      receiver_buffer, JSArrayBuffer::kBitFieldOffset, MachineType::Int8());
+      receiver_buffer, JSArrayBuffer::kBitFieldOffset, MachineType::Uint32());
   Label if_receiverisneutered(assembler, Label::kDeferred);
   assembler->GotoUnless(
       assembler->Word32Equal(
           assembler->Word32And(
               receiver_buffer_bit_field,
               assembler->Int32Constant(JSArrayBuffer::WasNeutered::kMask)),
           assembler->Int32Constant(0)),
       &if_receiverisneutered);
   assembler->Return(assembler->LoadObjectField(receiver, object_offset));
 
@@ skipping 2904 matching lines @@
 BUILTIN_LIST_H(DEFINE_BUILTIN_ACCESSOR_H)
 BUILTIN_LIST_DEBUG_A(DEFINE_BUILTIN_ACCESSOR_A)
 #undef DEFINE_BUILTIN_ACCESSOR_C
 #undef DEFINE_BUILTIN_ACCESSOR_A
 #undef DEFINE_BUILTIN_ACCESSOR_T
 #undef DEFINE_BUILTIN_ACCESSOR_S
 #undef DEFINE_BUILTIN_ACCESSOR_H
 
 }  // namespace internal
 }  // namespace v8