[typedarrays] Check detached buffer at start of typed array methods

src/compiler/js-intrinsic-lowering.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-intrinsic-lowering.h"
 
 #include <stack>
 
 #include "src/code-factory.h"
 #include "src/compiler/access-builder.h"
@@ skipping 68 matching lines @@
     case Runtime::kInlineCall:
       return ReduceCall(node);
     case Runtime::kInlineGetSuperConstructor:
       return ReduceGetSuperConstructor(node);
     case Runtime::kInlineArrayBufferViewGetByteLength:
       return ReduceArrayBufferViewField(
           node, AccessBuilder::ForJSArrayBufferViewByteLength());
     case Runtime::kInlineArrayBufferViewGetByteOffset:
       return ReduceArrayBufferViewField(
           node, AccessBuilder::ForJSArrayBufferViewByteOffset());
+    case Runtime::kInlineArrayBufferViewWasNeutered:
+      return ReduceArrayBufferViewWasNeutered(node);
     case Runtime::kInlineMaxSmi:
       return ReduceMaxSmi(node);
     case Runtime::kInlineTypedArrayGetLength:
       return ReduceArrayBufferViewField(node,
                                         AccessBuilder::ForJSTypedArrayLength());
     case Runtime::kInlineTypedArrayMaxSizeInHeap:
       return ReduceTypedArrayMaxSizeInHeap(node);
     case Runtime::kInlineJSCollectionGetTable:
       return ReduceJSCollectionGetTable(node);
     case Runtime::kInlineStringGetRawHashField:
@@ skipping 268 matching lines @@
 
   // Default to zero if the {receiver}s buffer was neutered.
   value = graph()->NewNode(
       common()->Select(MachineRepresentation::kTagged, BranchHint::kFalse),
       check, jsgraph()->ZeroConstant(), value);
 
   ReplaceWithValue(node, value, effect, control);
   return Replace(value);
 }
 
+Reduction JSIntrinsicLowering::ReduceArrayBufferViewWasNeutered(Node* node) {
+  Node* receiver = NodeProperties::GetValueInput(node, 0);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Check if the {receiver}s buffer was neutered.
+  Node* receiver_buffer = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForJSArrayBufferViewBuffer()),
+      receiver, effect, control);
+  Node* value = effect = graph()->NewNode(
+      simplified()->ArrayBufferWasNeutered(), receiver_buffer, effect, control);
+
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
+
 Reduction JSIntrinsicLowering::ReduceMaxSmi(Node* node) {
   Node* value = jsgraph()->Constant(Smi::kMaxValue);
   ReplaceWithValue(node, value);
   return Replace(value);
 }
 
 Reduction JSIntrinsicLowering::ReduceTypedArrayMaxSizeInHeap(Node* node) {
   Node* value = jsgraph()->Constant(FLAG_typed_array_max_size_in_heap);
   ReplaceWithValue(node, value);
   return Replace(value);
@@ skipping 92 matching lines @@
   return jsgraph_->javascript();
 }
 
 SimplifiedOperatorBuilder* JSIntrinsicLowering::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8