Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(919)

Side by Side Diff: src/crankshaft/hydrogen.cc

Issue 2778623003: [typedarrays] Check detached buffer at start of typed array methods (Closed)
Patch Set: crankshaft inline Created 3 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2013 the V8 project authors. All rights reserved. 1 // Copyright 2013 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "src/crankshaft/hydrogen.h" 5 #include "src/crankshaft/hydrogen.h"
6 6
7 #include <memory> 7 #include <memory>
8 #include <sstream> 8 #include <sstream>
9 9
10 #include "src/allocation-site-scopes.h" 10 #include "src/allocation-site-scopes.h"
(...skipping 9905 matching lines...) Expand 10 before | Expand all | Expand 10 after
9916 NoObservableSideEffectsScope scope(this); 9916 NoObservableSideEffectsScope scope(this);
9917 DCHECK(expr->arguments()->length() == 1); 9917 DCHECK(expr->arguments()->length() == 1);
9918 CHECK_ALIVE(VisitForValue(expr->arguments()->at(0))); 9918 CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
9919 HValue* view = Pop(); 9919 HValue* view = Pop();
9920 9920
9921 return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor( 9921 return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
9922 view, nullptr, 9922 view, nullptr,
9923 FieldIndex::ForInObjectOffset(JSArrayBufferView::kByteOffsetOffset))); 9923 FieldIndex::ForInObjectOffset(JSArrayBufferView::kByteOffsetOffset)));
9924 } 9924 }
9925 9925
9926 void HOptimizedGraphBuilder::GenerateArrayBufferViewWasNeutered(
9927 CallRuntime* expr) {
9928 NoObservableSideEffectsScope scope(this);
9929 DCHECK(expr->arguments()->length() == 1);
9930 CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
9931 HValue* view = Pop();
9932
9933 HInstruction* buffer = Add<HLoadNamedField>(
9934 view, nullptr, HObjectAccess::ForJSArrayBufferViewBuffer());
9935 HInstruction* flags = Add<HLoadNamedField>(
9936 buffer, nullptr, HObjectAccess::ForJSArrayBufferBitField());
9937 HValue* was_neutered_mask =
9938 Add<HConstant>(1 << JSArrayBuffer::WasNeutered::kShift);
9939 HValue* was_neutered =
9940 AddUncasted<HBitwise>(Token::BIT_AND, flags, was_neutered_mask);
9941 return ast_context()->ReturnValue(was_neutered);
9942 }
9926 9943
9927 void HOptimizedGraphBuilder::GenerateTypedArrayGetLength( 9944 void HOptimizedGraphBuilder::GenerateTypedArrayGetLength(
9928 CallRuntime* expr) { 9945 CallRuntime* expr) {
9929 NoObservableSideEffectsScope scope(this); 9946 NoObservableSideEffectsScope scope(this);
9930 DCHECK(expr->arguments()->length() == 1); 9947 DCHECK(expr->arguments()->length() == 1);
9931 CHECK_ALIVE(VisitForValue(expr->arguments()->at(0))); 9948 CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
9932 HValue* view = Pop(); 9949 HValue* view = Pop();
9933 9950
9934 return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor( 9951 return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
9935 view, nullptr, 9952 view, nullptr,
(...skipping 2798 matching lines...) Expand 10 before | Expand all | Expand 10 after
12734 isolate()->GetHTracer()->TraceHydrogen(name(), graph_); 12751 isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
12735 } 12752 }
12736 12753
12737 #ifdef DEBUG 12754 #ifdef DEBUG
12738 graph_->Verify(false); // No full verify. 12755 graph_->Verify(false); // No full verify.
12739 #endif 12756 #endif
12740 } 12757 }
12741 12758
12742 } // namespace internal 12759 } // namespace internal
12743 } // namespace v8 12760 } // namespace v8
OLDNEW
« no previous file with comments | « src/crankshaft/hydrogen.h ('k') | src/js/typedarray.js » ('j') | src/js/typedarray.js » ('J')

Powered by Google App Engine
This is Rietveld 408576698