[turbofan] Fix typed lowering of typed array loads/stores.

src/factory.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/factory.h"
 
 #include "src/allocation-site-scopes.h"
 #include "src/base/bits.h"
 #include "src/conversions.h"
 #include "src/isolate-inl.h"
@@ skipping 1713 matching lines @@
   case kExternal##Type##Array:                          \
     return EXTERNAL_##TYPE##_ELEMENTS;
     TYPED_ARRAYS(TYPED_ARRAY_CASE)
   }
   UNREACHABLE();
   return FIRST_EXTERNAL_ARRAY_ELEMENTS_KIND;
 #undef TYPED_ARRAY_CASE
 }
 
 
+size_t GetExternalArrayElementSize(ExternalArrayType type) {
+  switch (type) {
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
+  case kExternal##Type##Array:                          \
+    return size;
+    TYPED_ARRAYS(TYPED_ARRAY_CASE)
+  }
+  UNREACHABLE();
+  return 0;
+#undef TYPED_ARRAY_CASE
+}
+
+
 JSFunction* GetTypedArrayFun(ExternalArrayType type, Isolate* isolate) {
   Context* native_context = isolate->context()->native_context();
   switch (type) {
 #define TYPED_ARRAY_FUN(Type, type, TYPE, ctype, size)                        \
     case kExternal##Type##Array:                                              \
       return native_context->type##_array_fun();
 
     TYPED_ARRAYS(TYPED_ARRAY_FUN)
 #undef TYPED_ARRAY_FUN
 
@@ skipping 18 matching lines @@
 
 Handle<JSTypedArray> Factory::NewJSTypedArray(ExternalArrayType type,
                                               Handle<JSArrayBuffer> buffer,
                                               size_t length) {
   DCHECK(length <= static_cast<size_t>(kMaxInt));
   Handle<JSTypedArray> array = NewJSTypedArray(type);
   array->set_buffer(*buffer);
   array->set_weak_next(buffer->weak_first_view());
   buffer->set_weak_first_view(*array);
   array->set_byte_offset(Smi::FromInt(0));
-  array->set_byte_length(buffer->byte_length());
+  Handle<Object> byte_length_handle =

[Dmitry Lomov (no reviews), 2014/10/10 08:43:02]

DBC: why we have this Factory::NewJSTypedArray?

Where is it used?

Can we add a proper byte_offset argument to it?

Can we add proper validation of all arguments and sizes? (byte length fits into
ArrayBuffer etc?) Historically, this is a place where security bugs brew. 

+      NewNumberFromSize(length * GetExternalArrayElementSize(type));
+  array->set_byte_length(*byte_length_handle);
   Handle<Object> length_handle = NewNumberFromSize(length);
   array->set_length(*length_handle);
   Handle<ExternalArray> elements =
       NewExternalArray(static_cast<int>(length), type, buffer->backing_store());
   JSObject::SetMapAndElements(array,
                               JSObject::GetElementsTransitionMap(
                                   array, GetExternalArrayElementsKind(type)),
                               elements);
   return array;
 }
@@ skipping 653 matching lines @@
   return Handle<Object>::null();
 }
 
 
 Handle<Object> Factory::ToBoolean(bool value) {
   return value ? true_value() : false_value();
 }
 
 
 } }  // namespace v8::internal