Commit 3f27bb21 authored by machenbach's avatar machenbach Committed by Commit bot

Revert of Make it possible to hoist the neutering check for TA property...

Revert of Make it possible to hoist the neutering check for TA property accesses (patchset #1 id:1 of https://codereview.chromium.org/1107993002/)

Reason for revert:
[Sheriff] Breaks benchmarks:
http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/3403

Original issue's description:
> Make it possible to hoist the neutering check for TA property accesses
>
> Also correctly set up the dependency between propoerty and elements
> accesses and the checks
>
> BUG=v8:3996
> R=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/6a62e321381e1a212983804c4197068e842b240f
> Cr-Commit-Position: refs/heads/master@{#28087}

TBR=hpayer@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1108823003

Cr-Commit-Position: refs/heads/master@{#28088}
parent 6a62e321
......@@ -2465,21 +2465,19 @@ HInstruction* HGraphBuilder::BuildUncheckedMonomorphicElementAccess(
length_checker.End();
return result;
} else {
HValue* neuter_checked_object = checked_object;
if (IsExternalArrayElementsKind(elements_kind)) {
HInstruction* buffer =
Add<HLoadNamedField>(checked_object, nullptr,
HObjectAccess::ForJSArrayBufferViewBuffer());
HInstruction* buffer_length = Add<HLoadNamedField>(
buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
neuter_checked_object =
Add<HBoundsCheck>(graph()->GetConstant0(), buffer_length);
Add<HBoundsCheck>(graph()->GetConstant0(), buffer_length);
}
DCHECK(store_mode == STANDARD_STORE);
checked_key = Add<HBoundsCheck>(key, length);
return AddElementAccess(backing_store, checked_key, val,
neuter_checked_object, elements_kind,
access_type);
return AddElementAccess(
backing_store, checked_key, val,
checked_object, elements_kind, access_type);
}
}
DCHECK(fast_smi_only_elements ||
......@@ -6342,16 +6340,8 @@ HValue* HOptimizedGraphBuilder::BuildMonomorphicAccess(
if (info->GetJSArrayBufferViewFieldAccess(&access)) {
DCHECK(info->IsLoad());
HValue* neuter_checked_object = checked_object;
if (IsExternalArrayElementsKind(info->map()->elements_kind())) {
HInstruction* buffer = Add<HLoadNamedField>(
checked_object, nullptr, HObjectAccess::ForJSArrayBufferViewBuffer());
HInstruction* buffer_length = Add<HLoadNamedField>(
buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
neuter_checked_object =
Add<HBoundsCheck>(graph()->GetConstant0(), buffer_length);
}
return New<HLoadNamedField>(object, neuter_checked_object, access);
return BuildArrayBufferViewFieldAccessor(
object, checked_object, FieldIndex::ForInObjectOffset(access.offset()));
}
if (info->name().is_identical_to(isolate()->factory()->prototype_string()) &&
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment