Harden some INLINE_OPTIMIZED runtime bultins.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 8621 matching lines @@
 
   CHECK_ALIVE(VisitForValue(arguments->at(1)));
   HValue* buffer = Pop();
 
   CHECK_ALIVE(VisitForValue(arguments->at(2)));
   HValue* byte_offset = Pop();
 
   CHECK_ALIVE(VisitForValue(arguments->at(3)));
   HValue* byte_length = Pop();
 
+  IfBuilder checker(this);
+  checker.If<HHasInstanceTypeAndBranch>(obj, JS_DATA_VIEW_TYPE);
+  checker.AndIf<HHasInstanceTypeAndBranch>(buffer, JS_ARRAY_BUFFER_TYPE);
+  checker.AndIf<HIsSmiAndBranch>(byte_offset);
+  checker.AndIf<HIsSmiAndBranch>(byte_length);
+  checker.And();
+  HValue* zero = graph()->GetConstant0();
+  HValue* buffer_length =
+      Add<HLoadNamedField>(buffer,
+                           static_cast<HValue*>(NULL),
+                           HObjectAccess::ForJSArrayBufferByteLength());
+  checker.If<HIsSmiAndBranch>(buffer_length);
+  checker.And();
+  HValue* smi_byte_offset =
+      AddUncasted<HForceRepresentation>(byte_offset, Representation::Smi());
+  HValue* smi_byte_length =
+      AddUncasted<HForceRepresentation>(byte_length, Representation::Smi());
+  HValue* smi_buffer_length =
+     AddUncasted<HForceRepresentation>(buffer_length, Representation::Smi());
+  checker.If<HCompareNumericAndBranch>(smi_byte_offset, zero, Token::GTE);
+  checker.And();
+  checker.If<HCompareNumericAndBranch>(
+      smi_byte_length, zero, Token::GTE);
+  checker.And();
+  checker.If<HCompareNumericAndBranch>(
+      smi_byte_offset, smi_buffer_length, Token::LTE);
+  checker.And();
+  HValue* view_length = AddUncasted<HAdd>(byte_offset, byte_length);
+  checker.If<HCompareNumericAndBranch>(
+      view_length, smi_buffer_length, Token::LTE);
+
+  checker.Then();
   BuildArrayBufferViewInitialization<JSDataView>(
       obj, buffer, byte_offset, byte_length);
+
+  checker.Else();
+  Push(obj);
+  Push(buffer);
+  Push(byte_offset);
+  Push(byte_length);
+  PushArgumentsFromEnvironment(4);
+  Add<HCallRuntime>(expr->name(), expr->function(), 4);
+  checker.End();
 }
 
 
 static Handle<Map> TypedArrayMap(Isolate* isolate,
                                  ExternalArrayType array_type,
                                  ElementsKind target_kind) {
   Handle<Context> native_context = isolate->native_context();
   Handle<JSFunction> fun;
   switch (array_type) {
 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                       \
     case kExternal##Type##Array:                                              \
       fun = Handle<JSFunction>(native_context->type##_array_fun());           \
       break;
 
     TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
   }
   Handle<Map> map(fun->initial_map());
   return Map::AsElementsKind(map, target_kind);
 }
 
-
 HValue* HOptimizedGraphBuilder::BuildAllocateExternalElements(
     ExternalArrayType array_type,
     bool is_zero_byte_offset,
     HValue* buffer, HValue* byte_offset, HValue* length) {
   Handle<Map> external_array_map(
       isolate()->heap()->MapForExternalArrayType(array_type));
 
   // The HForceRepresentation is to prevent possible deopt on int-smi
   // conversion after allocation but before the new object fields are set.
   length = AddUncasted<HForceRepresentation>(length, Representation::Smi());
@@ skipping 206 matching lines @@
 
 void HOptimizedGraphBuilder::GenerateTypedArrayMaxSizeInHeap(
     CallRuntime* expr) {
   ASSERT(expr->arguments()->length() == 0);
   HConstant* result = New<HConstant>(static_cast<int32_t>(
         FLAG_typed_array_max_size_in_heap));
   return ast_context()->ReturnInstruction(result, expr->id());
 }
 
 
+void HOptimizedGraphBuilder::GenerateSimpleGetter(
+    CallRuntime* expr,
+    InstanceType instance_type,
+    HObjectAccess object_access) {
+  NoObservableSideEffectsScope scope(this);
+  ASSERT(expr->arguments()->length() == 1);
+  CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
+  HValue* buffer = Pop();
+  IfBuilder check_instance_type(this);
+  check_instance_type.If<HHasInstanceTypeAndBranch>(
+      buffer,
+      instance_type);
+  check_instance_type.Then();
+  HInstruction* result = Add<HLoadNamedField>(
+    buffer,
+    static_cast<HValue*>(NULL),
+    object_access);
+  Push(result);
+
+  check_instance_type.Else();
+  Push(buffer);
+  PushArgumentsFromEnvironment(1);
+  Push(Add<HCallRuntime>(expr->name(), expr->function(), 1));
+  check_instance_type.End();
+  return ast_context()->ReturnValue(Pop());
+}
+
+
 void HOptimizedGraphBuilder::GenerateArrayBufferGetByteLength(
     CallRuntime* expr) {
-  ASSERT(expr->arguments()->length() == 1);
-  CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
-  HValue* buffer = Pop();
-  HInstruction* result = New<HLoadNamedField>(
-    buffer,
-    static_cast<HValue*>(NULL),
-    HObjectAccess::ForJSArrayBufferByteLength());
-  return ast_context()->ReturnInstruction(result, expr->id());
+  GenerateSimpleGetter(
+      expr,
+      JS_ARRAY_BUFFER_TYPE,
+      HObjectAccess::ForJSArrayBufferByteLength());
 }
 
 
-void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteLength(
+void HOptimizedGraphBuilder::GenerateTypedArrayGetByteLength(
     CallRuntime* expr) {
-  ASSERT(expr->arguments()->length() == 1);
-  CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
-  HValue* buffer = Pop();
-  HInstruction* result = New<HLoadNamedField>(
-    buffer,
-    static_cast<HValue*>(NULL),
-    HObjectAccess::ForJSArrayBufferViewByteLength());
-  return ast_context()->ReturnInstruction(result, expr->id());
+  GenerateSimpleGetter(
+      expr,
+      JS_TYPED_ARRAY_TYPE,
+      HObjectAccess::ForJSArrayBufferViewByteLength());
 }
 
 
-void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteOffset(
+void HOptimizedGraphBuilder::GenerateTypedArrayGetByteOffset(
     CallRuntime* expr) {
-  ASSERT(expr->arguments()->length() == 1);
-  CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
-  HValue* buffer = Pop();
-  HInstruction* result = New<HLoadNamedField>(
-    buffer,
-    static_cast<HValue*>(NULL),
-    HObjectAccess::ForJSArrayBufferViewByteOffset());
-  return ast_context()->ReturnInstruction(result, expr->id());
+  GenerateSimpleGetter(
+      expr,
+      JS_TYPED_ARRAY_TYPE,
+      HObjectAccess::ForJSArrayBufferViewByteOffset());
+}
+
+
+void HOptimizedGraphBuilder::GenerateDataViewGetByteLength(
+    CallRuntime* expr) {
+  GenerateSimpleGetter(
+      expr,
+      JS_DATA_VIEW_TYPE,
+      HObjectAccess::ForJSArrayBufferViewByteLength());
+}
+
+
+void HOptimizedGraphBuilder::GenerateDataViewGetByteOffset(
+    CallRuntime* expr) {
+  GenerateSimpleGetter(
+      expr,
+      JS_DATA_VIEW_TYPE,
+      HObjectAccess::ForJSArrayBufferViewByteOffset());
 }
 
 
 void HOptimizedGraphBuilder::GenerateTypedArrayGetLength(
     CallRuntime* expr) {
-  ASSERT(expr->arguments()->length() == 1);
-  CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
-  HValue* buffer = Pop();
-  HInstruction* result = New<HLoadNamedField>(
-    buffer,
-    static_cast<HValue*>(NULL),
-    HObjectAccess::ForJSTypedArrayLength());
-  return ast_context()->ReturnInstruction(result, expr->id());
+  GenerateSimpleGetter(
+      expr,
+      JS_TYPED_ARRAY_TYPE,
+      HObjectAccess::ForJSTypedArrayLength());
 }
 
 
 void HOptimizedGraphBuilder::VisitCallRuntime(CallRuntime* expr) {
   ASSERT(!HasStackOverflow());
   ASSERT(current_block() != NULL);
   ASSERT(current_block()->HasPredecessor());
   if (expr->is_jsruntime()) {
     return Bailout(kCallToAJavaScriptRuntimeFunction);
   }
@@ skipping 2738 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal