[turbofan] Fix typed lowering of typed array loads/stores.

[turbofan] Fix typed lowering of typed array loads/stores.

R=jarin@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=24514

[Jarin, 2014-10-10 08:08:37]

lgtm.

https://codereview.chromium.org/646483003/diff/1/src/factory.cc
File src/factory.cc (right):

https://codereview.chromium.org/646483003/diff/1/src/factory.cc#newcode1786
src/factory.cc:1786: NewNumberFromSize(length *
GetExternalArrayElementSize(type));
Why cannot you say array->element_size() here?

[Benedikt Meurer, 2014-10-10 08:10:02]

https://codereview.chromium.org/646483003/diff/1/src/factory.cc
File src/factory.cc (right):

https://codereview.chromium.org/646483003/diff/1/src/factory.cc#newcode1786
src/factory.cc:1786: NewNumberFromSize(length *
GetExternalArrayElementSize(type));
Would be fragile to call element_size on a not yet fully initialized object. It
would work now, but it might easily break at some point.

[Benedikt Meurer, 2014-10-10 08:10:39]

Committed patchset #2 (id:60001) manually as 24514 (presubmit successful).

[Dmitry Lomov (no reviews), 2014-10-10 08:43:01]

dslomov@chromium.org changed reviewers:
+ dslomov@chromium.org

[Dmitry Lomov (no reviews), 2014-10-10 08:43:02]

https://codereview.chromium.org/646483003/diff/60001/src/factory.cc
File src/factory.cc (right):

https://codereview.chromium.org/646483003/diff/60001/src/factory.cc#newcode1785
src/factory.cc:1785: Handle<Object> byte_length_handle =
DBC: why we have this Factory::NewJSTypedArray?

Where is it used?

Can we add a proper byte_offset argument to it?

Can we add proper validation of all arguments and sizes? (byte length fits into
ArrayBuffer etc?) Historically, this is a place where security bugs brew.

[Benedikt Meurer, 2014-10-10 10:22:46]

It's currently used in tests only. I had a hard time collecting the bits and
pieces necessary to simply create a JSTypedArray. Feel free to improve the
method.

[Dmitry Lomov (no reviews), 2014-10-10 11:24:20]

On 2014/10/10 10:22:46, Benedikt Meurer wrote:
> It's currently used in tests only. I had a hard time collecting the bits and
> pieces necessary to simply create a JSTypedArray. Feel free to improve the
> method.

Tests can probably use our public API, or is there some issue with that?