[turbofan] Don't crash when typing load from a Uint8ClampedArray.

src/compiler/typer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/bootstrapper.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/graph-reducer.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/node.h"
 #include "src/compiler/node-properties-inl.h"
@@ skipping 15 matching lines @@
   V(Float32)            \
   V(Float64)
 
 enum LazyCachedType {
   kNumberFunc0,
   kNumberFunc1,
   kNumberFunc2,
   kImulFunc,
   kClz32Func,
   kArrayBufferFunc,
-#define NATIVE_TYPE_CASE(Type) k##Type, k##Type##Array, k##Type##ArrayFunc,
-  NATIVE_TYPES(NATIVE_TYPE_CASE)
-#undef NATIVE_TYPE_CASE
-  kNumLazyCachedTypes
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
+  k##Type, k##Type##Array, k##Type##ArrayFunc,
+  TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
+      kNumLazyCachedTypes
 };
 
 
 // Constructs and caches types lazily.
 // TODO(turbofan): these types could be globally cached or cached per isolate.
 class LazyTypeCache FINAL : public ZoneObject {
  public:
   explicit LazyTypeCache(Zone* zone) : zone_(zone) {
     memset(cache_, 0, sizeof(cache_));
   }
@@ skipping 18 matching lines @@
         return CreateNative(CreateRange<uint16_t>(),
                             Type::UntaggedUnsigned16());
       case kInt32:
         return CreateNative(Type::Signed32(), Type::UntaggedSigned32());
       case kUint32:
         return CreateNative(Type::Unsigned32(), Type::UntaggedUnsigned32());
       case kFloat32:
         return CreateNative(Type::Number(), Type::UntaggedFloat32());
       case kFloat64:
         return CreateNative(Type::Number(), Type::UntaggedFloat64());
+      case kUint8Clamped:
+        return Get(kUint8);
       case kNumberFunc0:
         return Type::Function(Type::Number(), zone());
       case kNumberFunc1:
         return Type::Function(Type::Number(), Type::Number(), zone());
       case kNumberFunc2:
         return Type::Function(Type::Number(), Type::Number(), Type::Number(),
                               zone());
       case kImulFunc:
         return Type::Function(Type::Signed32(), Type::Integral32(),
                               Type::Integral32(), zone());
       case kClz32Func:
         return Type::Function(CreateRange(0, 32), Type::Number(), zone());
       case kArrayBufferFunc:
         return Type::Function(Type::Object(zone()), Type::Unsigned32(), zone());
-#define NATIVE_TYPE_CASE(Type)        \
-  case k##Type##Array:                \
-    return CreateArray(Get(k##Type)); \
-  case k##Type##ArrayFunc:            \
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
+  case k##Type##Array:                                  \
+    return CreateArray(Get(k##Type));                   \
+  case k##Type##ArrayFunc:                              \
     return CreateArrayFunction(Get(k##Type##Array));
-        NATIVE_TYPES(NATIVE_TYPE_CASE)
-#undef NATIVE_TYPE_CASE
+        TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
       case kNumLazyCachedTypes:
         break;
     }
     UNREACHABLE();
     return NULL;
   }
 
   Type* CreateArray(Type* element) const {
     return Type::Array(element, zone());
   }
@@ skipping 1499 matching lines @@
 
 Bounds Typer::Visitor::TypeLoadField(Node* node) {
   return Bounds(FieldAccessOf(node->op()).type);
 }
 
 
 Bounds Typer::Visitor::TypeLoadBuffer(Node* node) {
   // TODO(bmeurer): This typing is not yet correct. Since we can still access
   // out of bounds, the type in the general case has to include Undefined.
   switch (BufferAccessOf(node->op()).external_array_type()) {
-#define NATIVE_TYPE_CASE(Type) \
-  case kExternal##Type##Array: \
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
+  case kExternal##Type##Array:                          \
     return Bounds(typer_->cache_->Get(k##Type));
-    NATIVE_TYPES(NATIVE_TYPE_CASE)
-#undef NATIVE_TYPE_CASE
-    case kExternalUint8ClampedArray:
-      break;
+    TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
   }
   UNREACHABLE();
   return Bounds();
 }
 
 
 Bounds Typer::Visitor::TypeLoadElement(Node* node) {
   return Bounds(ElementAccessOf(node->op()).type);
 }
 
@@ skipping 446 matching lines @@
       } else if (*value == native->uint32_array_fun()) {
         return typer_->cache_->Get(kUint32ArrayFunc);
       } else if (*value == native->float32_array_fun()) {
         return typer_->cache_->Get(kFloat32ArrayFunc);
       } else if (*value == native->float64_array_fun()) {
         return typer_->cache_->Get(kFloat64ArrayFunc);
       }
     }
   } else if (value->IsJSTypedArray()) {
     switch (JSTypedArray::cast(*value)->type()) {
-#define NATIVE_TYPE_CASE(Type) \
-  case kExternal##Type##Array: \
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
+  case kExternal##Type##Array:                          \
     return typer_->cache_->Get(k##Type##Array);
-      NATIVE_TYPES(NATIVE_TYPE_CASE)
-#undef NATIVE_TYPE_CASE
-      case kExternalUint8ClampedArray:
-        // TODO(rossberg): Do we want some ClampedArray type to express this?
-        break;
+      TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
     }
   }
   return Type::Constant(value, zone());
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8