[turbofan] Inline bunch of ArrayBuffer view accessors.

src/compiler/js-builtin-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-builtin-reducer.h"
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
@@ skipping 525 matching lines @@
     // String.fromCharCode(a:plain-primitive) -> StringFromCharCode(a)
     Node* input = ToNumber(r.GetJSCallInput(0));
     Node* value = graph()->NewNode(simplified()->StringFromCharCode(), input);
     return Replace(value);
   }
   return NoChange();
 }
 
 namespace {
 
-Node* GetStringReceiver(Node* node) {
+Node* GetStringWitness(Node* node) {
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Type* receiver_type = NodeProperties::GetType(receiver);
   Node* effect = NodeProperties::GetEffectInput(node);
   if (receiver_type->Is(Type::String())) return receiver;
   // Check if the {node} is dominated by a CheckString renaming for
   // it's {receiver}, and if so use that renaming as {receiver} for
   // the lowering below.
   for (Node* dominator = effect;;) {
     if (dominator->opcode() == IrOpcode::kCheckString &&
         dominator->InputAt(0) == receiver) {
@@ skipping 12 matching lines @@
 // ES6 section 21.1.3.1 String.prototype.charAt ( pos )
 Reduction JSBuiltinReducer::ReduceStringCharAt(Node* node) {
   // We need at least target, receiver and index parameters.
   if (node->op()->ValueInputCount() >= 3) {
     Node* index = NodeProperties::GetValueInput(node, 2);
     Type* index_type = NodeProperties::GetType(index);
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
 
     if (index_type->Is(Type::Unsigned32())) {
-      if (Node* receiver = GetStringReceiver(node)) {
+      if (Node* receiver = GetStringWitness(node)) {
         // Determine the {receiver} length.
         Node* receiver_length = effect = graph()->NewNode(
             simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,
             effect, control);
 
         // Check if {index} is less than {receiver} length.
         Node* check = graph()->NewNode(simplified()->NumberLessThan(), index,
                                        receiver_length);
         Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
                                         check, control);
@@ skipping 30 matching lines @@
 // ES6 section 21.1.3.2 String.prototype.charCodeAt ( pos )
 Reduction JSBuiltinReducer::ReduceStringCharCodeAt(Node* node) {
   // We need at least target, receiver and index parameters.
   if (node->op()->ValueInputCount() >= 3) {
     Node* index = NodeProperties::GetValueInput(node, 2);
     Type* index_type = NodeProperties::GetType(index);
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
 
     if (index_type->Is(Type::Unsigned32())) {
-      if (Node* receiver = GetStringReceiver(node)) {
+      if (Node* receiver = GetStringWitness(node)) {
         // Determine the {receiver} length.
         Node* receiver_length = effect = graph()->NewNode(
             simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,
             effect, control);
 
         // Check if {index} is less than {receiver} length.
         Node* check = graph()->NewNode(simplified()->NumberLessThan(), index,
                                        receiver_length);
         Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
                                         check, control);
@@ skipping 14 matching lines @@
 
         ReplaceWithValue(node, value, effect, control);
         return Replace(value);
       }
     }
   }
 
   return NoChange();
 }
 
+namespace {
+
+bool HasInstanceTypeWitness(Node* receiver, Node* effect,
+                            InstanceType instance_type) {
+  for (Node* dominator = effect;;) {
+    if (dominator->opcode() == IrOpcode::kCheckMaps &&
+        dominator->InputAt(0) == receiver) {
+      // Check if all maps have the given {instance_type}.
+      for (int i = 1; i < dominator->op()->ValueInputCount(); ++i) {
+        Node* const map = NodeProperties::GetValueInput(dominator, i);
+        Type* const map_type = NodeProperties::GetType(map);
+        if (!map_type->IsConstant()) return false;
+        Handle<Map> const map_value =
+            Handle<Map>::cast(map_type->AsConstant()->Value());
+        if (map_value->instance_type() != instance_type) return false;
+      }
+      return true;
+    }
+    switch (dominator->opcode()) {
+      case IrOpcode::kStoreField: {
+        FieldAccess const& access = FieldAccessOf(dominator->op());
+        if (access.base_is_tagged == kTaggedBase &&
+            access.offset == HeapObject::kMapOffset) {
+          return false;
+        }
+        break;
+      }
+      case IrOpcode::kStoreElement:
+        break;
+      default: {
+        DCHECK_EQ(1, dominator->op()->EffectOutputCount());
+        if (dominator->op()->EffectInputCount() != 1 ||
+            !dominator->op()->HasProperty(Operator::kNoWrite)) {
+          // Didn't find any appropriate CheckMaps node.
+          return false;
+        }
+        break;
+      }
+    }
+    dominator = NodeProperties::GetEffectInput(dominator);
+  }
+}
+
+}  // namespace
+
+Reduction JSBuiltinReducer::ReduceArrayBufferViewAccessor(
+    Node* node, InstanceType instance_type, FieldAccess const& access) {
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  if (HasInstanceTypeWitness(receiver, effect, instance_type)) {
+    // Load the {receiver}s field.
+    Node* receiver_length = effect = graph()->NewNode(
+        simplified()->LoadField(access), receiver, effect, control);
+
+    // Check if the {receiver}s buffer was neutered.
+    Node* receiver_buffer = effect = graph()->NewNode(
+        simplified()->LoadField(AccessBuilder::ForJSArrayBufferViewBuffer()),
+        receiver, effect, control);
+    Node* receiver_buffer_bitfield = effect = graph()->NewNode(
+        simplified()->LoadField(AccessBuilder::ForJSArrayBufferBitField()),
+        receiver_buffer, effect, control);
+    Node* check = graph()->NewNode(
+        simplified()->NumberEqual(),
+        graph()->NewNode(
+            simplified()->NumberBitwiseAnd(), receiver_buffer_bitfield,
+            jsgraph()->Constant(JSArrayBuffer::WasNeutered::kMask)),
+        jsgraph()->ZeroConstant());
+
+    // Default to zero if the {receiver}s buffer was neutered.
+    Node* value =
+        graph()->NewNode(common()->Select(MachineRepresentation::kTagged),
+                         check, receiver_length, jsgraph()->ZeroConstant());
+
+    ReplaceWithValue(node, value, effect, control);
+    return Replace(value);
+  }
+  return NoChange();
+}
+
 Reduction JSBuiltinReducer::Reduce(Node* node) {
   Reduction reduction = NoChange();
   JSCallReduction r(node);
 
   // Dispatch according to the BuiltinFunctionId if present.
   if (!r.HasBuiltinFunctionId()) return NoChange();
   switch (r.GetBuiltinFunctionId()) {
     case kMathAbs:
       reduction = ReduceMathAbs(node);
       break;
@@ skipping 96 matching lines @@
     case kNumberParseInt:
       reduction = ReduceNumberParseInt(node);
       break;
     case kStringFromCharCode:
       reduction = ReduceStringFromCharCode(node);
       break;
     case kStringCharAt:
       return ReduceStringCharAt(node);
     case kStringCharCodeAt:
       return ReduceStringCharCodeAt(node);
+    case kDataViewByteLength:
+      return ReduceArrayBufferViewAccessor(
+          node, JS_DATA_VIEW_TYPE,
+          AccessBuilder::ForJSArrayBufferViewByteLength());
+    case kDataViewByteOffset:
+      return ReduceArrayBufferViewAccessor(
+          node, JS_DATA_VIEW_TYPE,
+          AccessBuilder::ForJSArrayBufferViewByteOffset());
+    case kTypedArrayByteLength:
+      return ReduceArrayBufferViewAccessor(
+          node, JS_TYPED_ARRAY_TYPE,
+          AccessBuilder::ForJSArrayBufferViewByteLength());
+    case kTypedArrayByteOffset:
+      return ReduceArrayBufferViewAccessor(
+          node, JS_TYPED_ARRAY_TYPE,
+          AccessBuilder::ForJSArrayBufferViewByteOffset());
+    case kTypedArrayLength:
+      return ReduceArrayBufferViewAccessor(
+          node, JS_TYPED_ARRAY_TYPE, AccessBuilder::ForJSTypedArrayLength());
     default:
       break;
   }
 
   // Replace builtin call assuming replacement nodes are pure values that don't
   // produce an effect. Replaces {node} with {reduction} and relaxes effects.
   if (reduction.Changed()) ReplaceWithValue(node, reduction.replacement());
 
   return reduction;
 }
@@ skipping 22 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSBuiltinReducer::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8