[builtins] throw if TypedArray buffer is detached during iteration

src/builtins/builtins-array.cc

Index: src/builtins/builtins-array.cc
diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
index 1df0477bfdfc02cfb98d5cf94b26677f43c86e3d..82171d36acf771ecdcd92be931ade1014d0e72b0 100644
--- a/src/builtins/builtins-array.cc
+++ b/src/builtins/builtins-array.cc
@@ -2277,6 +2277,10 @@ void Builtins::Generate_ArrayIteratorPrototypeNext(
   typedef CodeStubAssembler::Variable Variable;
   CodeStubAssembler assembler(state);
 
+  Node* operation =
+      assembler.HeapConstant(assembler.factory()->NewStringFromAsciiChecked(

[Benedikt Meurer, 2017/01/03 18:09:39]

The CodeStubAssembler generates a schedule immediately, which means that in the
worst case, it'll block one register from this point on to keep the constant.
Currently this shouldn't happen, but there's no guarantee. I'd suggest to just
leave the HeapConstant at the runtime call uses below.

[caitp, 2017/01/03 18:18:40]

Good point, done

+          "Array Iterator.prototype.next", TENURED));
+
   Node* iterator = assembler.Parameter(0);
   Node* context = assembler.Parameter(3);
 
@@ -2318,7 +2322,8 @@ void Builtins::Generate_ArrayIteratorPrototypeNext(
       iterator, JSArrayIterator::kIteratedObjectMapOffset);
   Node* array_map = assembler.LoadMap(array);
 
-  Label if_isfastarray(&assembler), if_isnotfastarray(&assembler);
+  Label if_isfastarray(&assembler), if_isnotfastarray(&assembler),
+      if_isdetached(&assembler, Label::kDeferred);
 
   assembler.Branch(assembler.WordEqual(orig_map, array_map), &if_isfastarray,
                    &if_isnotfastarray);
@@ -2529,35 +2534,13 @@ void Builtins::Generate_ArrayIteratorPrototypeNext(
 
     assembler.Bind(&if_istypedarray);
     {
-      Node* length = nullptr;
-      {
-        Variable var_length(&assembler, MachineRepresentation::kTagged);
-        Label if_isdetached(&assembler, Label::kDeferred),
-            if_isnotdetached(&assembler), done(&assembler);
-
-        Node* buffer =
-            assembler.LoadObjectField(array, JSTypedArray::kBufferOffset);
-        assembler.Branch(assembler.IsDetachedBuffer(buffer), &if_isdetached,
-                         &if_isnotdetached);
-
-        assembler.Bind(&if_isnotdetached);
-        {
-          var_length.Bind(
-              assembler.LoadObjectField(array, JSTypedArray::kLengthOffset));
-          assembler.Goto(&done);
-        }
+      Node* buffer =
+          assembler.LoadObjectField(array, JSTypedArray::kBufferOffset);
+      assembler.GotoIf(assembler.IsDetachedBuffer(buffer), &if_isdetached);
 
-        assembler.Bind(&if_isdetached);
-        {
-          // TODO(caitp): If IsDetached(buffer) is true, throw a TypeError, per
-          // https://github.com/tc39/ecma262/issues/713
-          var_length.Bind(assembler.SmiConstant(Smi::kZero));
-          assembler.Goto(&done);
-        }
+      Node* length =
+          assembler.LoadObjectField(array, JSTypedArray::kLengthOffset);
 
-        assembler.Bind(&done);
-        length = var_length.value();
-      }
       CSA_ASSERT(&assembler, assembler.TaggedIsSmi(length));
       CSA_ASSERT(&assembler, assembler.TaggedIsSmi(index));
 
@@ -2753,11 +2736,17 @@ void Builtins::Generate_ArrayIteratorPrototypeNext(
   assembler.Bind(&throw_bad_receiver);
   {
     // The {receiver} is not a valid JSArrayIterator.
-    Node* result = assembler.CallRuntime(
-        Runtime::kThrowIncompatibleMethodReceiver, context,
-        assembler.HeapConstant(assembler.factory()->NewStringFromAsciiChecked(
-            "Array Iterator.prototype.next", TENURED)),
-        iterator);
+    Node* result =
+        assembler.CallRuntime(Runtime::kThrowIncompatibleMethodReceiver,
+                              context, operation, iterator);
+    assembler.Return(result);
+  }
+
+  assembler.Bind(&if_isdetached);
+  {
+    Node* message = assembler.SmiConstant(MessageTemplate::kDetachedOperation);
+    Node* result = assembler.CallRuntime(Runtime::kThrowTypeError, context,
+                                         message, operation, array);
     assembler.Return(result);
   }
 }