Index: src/compiler/js-builtin-reducer.cc |
diff --git a/src/compiler/js-builtin-reducer.cc b/src/compiler/js-builtin-reducer.cc |
index bbd5a92a7fd0400a6b82cbf2f747e747405a24cd..86f6bd89000d50c6f782aad9e12b83ae6f316f6a 100644 |
--- a/src/compiler/js-builtin-reducer.cc |
+++ b/src/compiler/js-builtin-reducer.cc |
@@ -930,27 +930,21 @@ Reduction JSBuiltinReducer::ReduceArrayBufferViewAccessor( |
Node* control = NodeProperties::GetControlInput(node); |
if (HasInstanceTypeWitness(receiver, effect, instance_type)) { |
// Load the {receiver}s field. |
- Node* receiver_length = effect = graph()->NewNode( |
+ Node* receiver_value = effect = graph()->NewNode( |
simplified()->LoadField(access), receiver, effect, control); |
// Check if the {receiver}s buffer was neutered. |
Node* receiver_buffer = effect = graph()->NewNode( |
simplified()->LoadField(AccessBuilder::ForJSArrayBufferViewBuffer()), |
receiver, effect, control); |
- Node* receiver_buffer_bitfield = effect = graph()->NewNode( |
- simplified()->LoadField(AccessBuilder::ForJSArrayBufferBitField()), |
- receiver_buffer, effect, control); |
- Node* check = graph()->NewNode( |
- simplified()->NumberEqual(), |
- graph()->NewNode( |
- simplified()->NumberBitwiseAnd(), receiver_buffer_bitfield, |
- jsgraph()->Constant(JSArrayBuffer::WasNeutered::kMask)), |
- jsgraph()->ZeroConstant()); |
+ Node* check = effect = |
+ graph()->NewNode(simplified()->ArrayBufferWasNeutered(), |
+ receiver_buffer, effect, control); |
// Default to zero if the {receiver}s buffer was neutered. |
Node* value = graph()->NewNode( |
- common()->Select(MachineRepresentation::kTagged, BranchHint::kTrue), |
- check, receiver_length, jsgraph()->ZeroConstant()); |
+ common()->Select(MachineRepresentation::kTagged, BranchHint::kFalse), |
+ check, jsgraph()->ZeroConstant(), receiver_value); |
ReplaceWithValue(node, value, effect, control); |
return Replace(value); |