[builtins] throw if TypedArray buffer is detached during iteration

src/builtins/builtins-array.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins.h"
 #include "src/builtins/builtins-utils.h"
 
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/contexts.h"
@@ skipping 2259 matching lines @@
   Generate_ArrayPrototypeIterationMethod<IterationKind::kKeys>(state);
 }
 
 void Builtins::Generate_ArrayIteratorPrototypeNext(
     compiler::CodeAssemblerState* state) {
   typedef compiler::Node Node;
   typedef CodeStubAssembler::Label Label;
   typedef CodeStubAssembler::Variable Variable;
   CodeStubAssembler assembler(state);
 
+  Handle<String> operation = assembler.factory()->NewStringFromAsciiChecked(
+      "Array Iterator.prototype.next", TENURED);
+
   Node* iterator = assembler.Parameter(0);
   Node* context = assembler.Parameter(3);
 
   Variable var_value(&assembler, MachineRepresentation::kTagged);
   Variable var_done(&assembler, MachineRepresentation::kTagged);
 
   // Required, or else `throw_bad_receiver` fails a DCHECK due to these
   // variables not being bound along all paths, despite not being used.
   var_done.Bind(assembler.TrueConstant());
   var_value.Bind(assembler.UndefinedConstant());
@@ skipping 21 matching lines @@
   Node* array = assembler.LoadObjectField(
       iterator, JSArrayIterator::kIteratedObjectOffset);
 
   // Let index be O.[[ArrayIteratorNextIndex]].
   Node* index =
       assembler.LoadObjectField(iterator, JSArrayIterator::kNextIndexOffset);
   Node* orig_map = assembler.LoadObjectField(
       iterator, JSArrayIterator::kIteratedObjectMapOffset);
   Node* array_map = assembler.LoadMap(array);
 
-  Label if_isfastarray(&assembler), if_isnotfastarray(&assembler);
+  Label if_isfastarray(&assembler), if_isnotfastarray(&assembler),
+      if_isdetached(&assembler, Label::kDeferred);
 
   assembler.Branch(assembler.WordEqual(orig_map, array_map), &if_isfastarray,
                    &if_isnotfastarray);
 
   assembler.Bind(&if_isfastarray);
   {
     CSA_ASSERT(&assembler,
                assembler.Word32Equal(assembler.LoadMapInstanceType(array_map),
                                      assembler.Int32Constant(JS_ARRAY_TYPE)));
 
@@ skipping 190 matching lines @@
       assembler.Bind(&generic_values);
       {
         Callable get_property = CodeFactory::GetProperty(assembler.isolate());
         var_value.Bind(assembler.CallStub(get_property, context, array, index));
         assembler.Goto(&allocate_entry_if_needed);
       }
     }
 
     assembler.Bind(&if_istypedarray);
     {
-      Node* length = nullptr;
-      {
-        Variable var_length(&assembler, MachineRepresentation::kTagged);
-        Label if_isdetached(&assembler, Label::kDeferred),
-            if_isnotdetached(&assembler), done(&assembler);
+      Node* buffer =
+          assembler.LoadObjectField(array, JSTypedArray::kBufferOffset);
+      assembler.GotoIf(assembler.IsDetachedBuffer(buffer), &if_isdetached);
 
-        Node* buffer =
-            assembler.LoadObjectField(array, JSTypedArray::kBufferOffset);
-        assembler.Branch(assembler.IsDetachedBuffer(buffer), &if_isdetached,
-                         &if_isnotdetached);
+      Node* length =
+          assembler.LoadObjectField(array, JSTypedArray::kLengthOffset);
 
-        assembler.Bind(&if_isnotdetached);
-        {
-          var_length.Bind(
-              assembler.LoadObjectField(array, JSTypedArray::kLengthOffset));
-          assembler.Goto(&done);
-        }
-
-        assembler.Bind(&if_isdetached);
-        {
-          // TODO(caitp): If IsDetached(buffer) is true, throw a TypeError, per
-          // https://github.com/tc39/ecma262/issues/713
-          var_length.Bind(assembler.SmiConstant(Smi::kZero));
-          assembler.Goto(&done);
-        }
-
-        assembler.Bind(&done);
-        length = var_length.value();
-      }
       CSA_ASSERT(&assembler, assembler.TaggedIsSmi(length));
       CSA_ASSERT(&assembler, assembler.TaggedIsSmi(index));
 
       assembler.GotoUnless(assembler.SmiBelow(index, length), &set_done);
 
       Node* one = assembler.SmiConstant(1);
       assembler.StoreObjectFieldNoWriteBarrier(
           iterator, JSArrayIterator::kNextIndexOffset,
           assembler.SmiAdd(index, one));
       var_done.Bind(assembler.FalseConstant());
@@ skipping 177 matching lines @@
     assembler.StoreObjectFieldNoWriteBarrier(
         result, JSIteratorResult::kDoneOffset, var_done.value());
     assembler.Return(result);
   }
 
   assembler.Bind(&throw_bad_receiver);
   {
     // The {receiver} is not a valid JSArrayIterator.
     Node* result = assembler.CallRuntime(
         Runtime::kThrowIncompatibleMethodReceiver, context,
-        assembler.HeapConstant(assembler.factory()->NewStringFromAsciiChecked(
-            "Array Iterator.prototype.next", TENURED)),
-        iterator);
+        assembler.HeapConstant(operation), iterator);
+    assembler.Return(result);
+  }
+
+  assembler.Bind(&if_isdetached);
+  {
+    Node* message = assembler.SmiConstant(MessageTemplate::kDetachedOperation);
+    Node* result =
+        assembler.CallRuntime(Runtime::kThrowTypeError, context, message,
+                              assembler.HeapConstant(operation));
     assembler.Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8