[turbofan] Introduce a dedicated ArrayBufferWasNeutered operator.

src/compiler/load-elimination.h

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_COMPILER_LOAD_ELIMINATION_H_
 #define V8_COMPILER_LOAD_ELIMINATION_H_
 
 #include "src/compiler/graph-reducer.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
 // Foward declarations.
 struct FieldAccess;
 class JSGraph;
 
 class LoadElimination final : public AdvancedReducer {
  public:
   LoadElimination(Editor* editor, JSGraph* jsgraph, Zone* zone)
       : AdvancedReducer(editor), node_states_(zone), jsgraph_(jsgraph) {}
   ~LoadElimination() final {}
 
   Reduction Reduce(Node* node) final;
 
  private:
+  static const size_t kMaxTrackedChecks = 8;
+
+  // Abstract state to approximate the current state of checks that are
+  // only invalidated by calls, i.e. array buffer neutering checks, along
+  // the effect paths through the graph.
+  class AbstractChecks final : public ZoneObject {
+   public:
+    explicit AbstractChecks(Zone* zone) {
+      for (size_t i = 0; i < arraysize(nodes_); ++i) {
+        nodes_[i] = nullptr;
+      }
+    }
+    AbstractChecks(Node* node, Zone* zone) : AbstractChecks(zone) {
+      nodes_[next_index_++] = node;
+    }
+
+    AbstractChecks const* Extend(Node* node, Zone* zone) const {
+      AbstractChecks* that = new (zone) AbstractChecks(*this);
+      that->nodes_[that->next_index_] = node;
+      that->next_index_ = (that->next_index_ + 1) % arraysize(nodes_);
+      return that;
+    }
+    Node* Lookup(Node* node) const;
+    bool Equals(AbstractChecks const* that) const;
+    AbstractChecks const* Merge(AbstractChecks const* that, Zone* zone) const;
+
+   private:
+    Node* nodes_[kMaxTrackedChecks];
+    size_t next_index_ = 0;
+  };
+
   static const size_t kMaxTrackedElements = 8;
 
   // Abstract state to approximate the current state of an element along the
   // effect paths through the graph.
   class AbstractElements final : public ZoneObject {
    public:
     explicit AbstractElements(Zone* zone) {
       for (size_t i = 0; i < arraysize(elements_); ++i) {
         elements_[i] = Element();
       }
@@ skipping 89 matching lines @@
     AbstractState const* KillField(Node* object, size_t index,
                                    Zone* zone) const;
     Node* LookupField(Node* object, size_t index) const;
 
     AbstractState const* AddElement(Node* object, Node* index, Node* value,
                                     Zone* zone) const;
     AbstractState const* KillElement(Node* object, Node* index,
                                      Zone* zone) const;
     Node* LookupElement(Node* object, Node* index) const;
 
+    AbstractState const* AddCheck(Node* node, Zone* zone) const;
+    Node* LookupCheck(Node* node) const;
+
    private:
+    AbstractChecks const* checks_ = nullptr;
     AbstractElements const* elements_ = nullptr;
     AbstractField const* fields_[kMaxTrackedFields];
   };
 
   class AbstractStateForEffectNodes final : public ZoneObject {
    public:
     explicit AbstractStateForEffectNodes(Zone* zone) : info_for_node_(zone) {}
     AbstractState const* Get(Node* node) const;
     void Set(Node* node, AbstractState const* state);
 
     Zone* zone() const { return info_for_node_.get_allocator().zone(); }
 
    private:
     ZoneVector<AbstractState const*> info_for_node_;
   };
 
+  Reduction ReduceArrayBufferWasNeutered(Node* node);
   Reduction ReduceCheckMaps(Node* node);
   Reduction ReduceEnsureWritableFastElements(Node* node);
   Reduction ReduceMaybeGrowFastElements(Node* node);
   Reduction ReduceTransitionElementsKind(Node* node);
   Reduction ReduceLoadField(Node* node);
   Reduction ReduceStoreField(Node* node);
   Reduction ReduceLoadElement(Node* node);
   Reduction ReduceStoreElement(Node* node);
   Reduction ReduceStoreTypedElement(Node* node);
   Reduction ReduceEffectPhi(Node* node);
@@ skipping 16 matching lines @@
   JSGraph* const jsgraph_;
 
   DISALLOW_COPY_AND_ASSIGN(LoadElimination);
 };
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_COMPILER_LOAD_ELIMINATION_H_