Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(97)

Unified Diff: src/compiler/js-builtin-reducer.cc

Issue 2279213002: [turbofan] Introduce a dedicated ArrayBufferWasNeutered operator. (Closed)
Patch Set: Created 4 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « src/compiler/effect-control-linearizer.cc ('k') | src/compiler/js-native-context-specialization.cc » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/compiler/js-builtin-reducer.cc
diff --git a/src/compiler/js-builtin-reducer.cc b/src/compiler/js-builtin-reducer.cc
index bbd5a92a7fd0400a6b82cbf2f747e747405a24cd..86f6bd89000d50c6f782aad9e12b83ae6f316f6a 100644
--- a/src/compiler/js-builtin-reducer.cc
+++ b/src/compiler/js-builtin-reducer.cc
@@ -930,27 +930,21 @@ Reduction JSBuiltinReducer::ReduceArrayBufferViewAccessor(
Node* control = NodeProperties::GetControlInput(node);
if (HasInstanceTypeWitness(receiver, effect, instance_type)) {
// Load the {receiver}s field.
- Node* receiver_length = effect = graph()->NewNode(
+ Node* receiver_value = effect = graph()->NewNode(
simplified()->LoadField(access), receiver, effect, control);
// Check if the {receiver}s buffer was neutered.
Node* receiver_buffer = effect = graph()->NewNode(
simplified()->LoadField(AccessBuilder::ForJSArrayBufferViewBuffer()),
receiver, effect, control);
- Node* receiver_buffer_bitfield = effect = graph()->NewNode(
- simplified()->LoadField(AccessBuilder::ForJSArrayBufferBitField()),
- receiver_buffer, effect, control);
- Node* check = graph()->NewNode(
- simplified()->NumberEqual(),
- graph()->NewNode(
- simplified()->NumberBitwiseAnd(), receiver_buffer_bitfield,
- jsgraph()->Constant(JSArrayBuffer::WasNeutered::kMask)),
- jsgraph()->ZeroConstant());
+ Node* check = effect =
+ graph()->NewNode(simplified()->ArrayBufferWasNeutered(),
+ receiver_buffer, effect, control);
// Default to zero if the {receiver}s buffer was neutered.
Node* value = graph()->NewNode(
- common()->Select(MachineRepresentation::kTagged, BranchHint::kTrue),
- check, receiver_length, jsgraph()->ZeroConstant());
+ common()->Select(MachineRepresentation::kTagged, BranchHint::kFalse),
+ check, jsgraph()->ZeroConstant(), receiver_value);
ReplaceWithValue(node, value, effect, control);
return Replace(value);
« no previous file with comments | « src/compiler/effect-control-linearizer.cc ('k') | src/compiler/js-native-context-specialization.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698