[torque] Move remaining DataView getters to Torque

This CL completely removes the C++ builtin implementation of the
DataView.prototype.buffer, DataView.prototype.byteLength, and
DataView.prototype.byteOffset getters, and moves them to
a Torque implementation (that still relies on a bit of CSA).

Change-Id: Id46678ae709c3787b7b93d0f78bd2a6e16e00f7b
Reviewed-on: https://chromium-review.googlesource.com/1070369
Commit-Queue: Théotime Grohens <theotime@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53339}

src/builtins/base.tq

@@ -41,6 +41,7 @@ type FixedTypedArray extends FixedTypedArrayBase generates
 type JSArrayBuffer extends Object generates 'TNode<JSArrayBuffer>';
 type JSArrayBufferView extends Object generates 'TNode<JSArrayBufferView>';
 type JSTypedArray extends JSArrayBufferView generates 'TNode<JSTypedArray>';
+type JSDataView extends JSArrayBufferView generates 'TNode<JSDataView>';
 
 type InstanceType extends int32 generates 'TNode<Int32T>';
 type ElementsKind generates 'TNode<Int32T>' constexpr 'ElementsKind';
@@ -107,6 +108,8 @@ const kDetachedOperation: MessageTemplate =
     'MessageTemplate::kDetachedOperation';
 const kBadSortComparisonFunction: MessageTemplate =
     'MessageTemplate::kBadSortComparisonFunction';
+const kIncompatibleMethodReceiver: MessageTemplate =
+    'MessageTemplate::kIncompatibleMethodReceiver';
 
 const Hole: Oddball = 'TheHoleConstant()';
 const Null: Oddball = 'NullConstant()';
@@ -215,6 +218,8 @@ extern operator '[]' macro GetArgumentValueSmiIndex(Arguments, Smi): Object;
 extern operator 'is<Smi>' macro TaggedIsSmi(Object): bool;
 extern operator 'isnt<Smi>' macro TaggedIsNotSmi(Object): bool;
 
+extern operator 'cast<>' macro TaggedToJSDataView(
+    Object): JSDataView labels CastError;
 extern operator
 'cast<>' macro TaggedToHeapObject(Object): HeapObject labels CastError;
 extern operator 'cast<>' macro TaggedToSmi(Object): Smi labels CastError;

src/builtins/builtins-data-view-gen.h

@@ -14,6 +14,14 @@ class DataViewBuiltinsAssembler : public CodeStubAssembler {
  public:
   explicit DataViewBuiltinsAssembler(compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state) {}
+
+  TNode<Smi> LoadDataViewByteOffset(TNode<JSDataView> data_view) {
+    return LoadObjectField<Smi>(data_view, JSDataView::kByteOffsetOffset);
+  }
+
+  TNode<Smi> LoadDataViewByteLength(TNode<JSDataView> data_view) {
+    return LoadObjectField<Smi>(data_view, JSDataView::kByteLengthOffset);
+  }
 };
 
 }  // namespace internal

src/builtins/builtins-dataview.cc

@@ -104,29 +104,5 @@ BUILTIN(DataViewConstructor) {
   }
 }
 
-// ES6 section 24.2.4.1 get DataView.prototype.buffer
-BUILTIN(DataViewPrototypeGetBuffer) {
-  HandleScope scope(isolate);
-  CHECK_RECEIVER(JSDataView, data_view, "get DataView.prototype.buffer");
-  return data_view->buffer();
-}
-
-// ES6 section 24.2.4.2 get DataView.prototype.byteLength
-BUILTIN(DataViewPrototypeGetByteLength) {
-  HandleScope scope(isolate);
-  CHECK_RECEIVER(JSDataView, data_view, "get DataView.prototype.byteLength");
-  // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
-  // here if the JSArrayBuffer of the {data_view} was neutered.
-  return data_view->byte_length();
-}
-
-// ES6 section 24.2.4.3 get DataView.prototype.byteOffset
-BUILTIN(DataViewPrototypeGetByteOffset) {
-  HandleScope scope(isolate);
-  CHECK_RECEIVER(JSDataView, data_view, "get DataView.prototype.byteOffset");
-  // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
-  // here if the JSArrayBuffer of the {data_view} was neutered.
-  return data_view->byte_offset();
-}
 }  // namespace internal
 }  // namespace v8

src/builtins/builtins-definitions.h

@@ -446,9 +446,6 @@ namespace internal {
   /* DataView */                                                               \
   /* ES #sec-dataview-constructor */                                           \
   CPP(DataViewConstructor)                                                     \
-  CPP(DataViewPrototypeGetBuffer)                                              \
-  CPP(DataViewPrototypeGetByteLength)                                          \
-  CPP(DataViewPrototypeGetByteOffset)                                          \
                                                                                \
   /* Date */                                                                   \
   /* ES #sec-date-constructor */                                               \

src/builtins/data-view.tq

@@ -4,6 +4,61 @@
 
 module data_view {
 
+  extern operator '.buffer' macro LoadArrayBufferViewBuffer(
+      JSArrayBufferView): JSArrayBuffer;
+  extern operator '.byte_length' macro LoadDataViewByteLength(JSDataView): Smi;
+  extern operator '.byte_offset' macro LoadDataViewByteOffset(JSDataView): Smi;
+
+  macro WasNeutered(view: JSArrayBufferView): bool {
+    return IsDetachedBuffer(view.buffer);
+  }
+
+  macro ValidateDataView(context: Context,
+        o: Object, method: String): JSDataView {
+    try {
+      return cast<JSDataView>(o) otherwise CastError;
+    }
+    label CastError {
+      ThrowTypeError(context, kIncompatibleMethodReceiver, method);
+    }
+  }
+
+  // ES6 section 24.2.4.1 get DataView.prototype.buffer
+  javascript builtin DataViewPrototypeGetBuffer(
+    context: Context, receiver: Object, ...arguments): JSArrayBuffer {
+      let data_view: JSDataView = ValidateDataView(
+          context, receiver, 'get DataView.prototype.buffer');
+      return data_view.buffer;
+  }
+
+  // ES6 section 24.2.4.2 get DataView.prototype.byteLength
+  javascript builtin DataViewPrototypeGetByteLength(
+    context: Context, receiver: Object, ...arguments): Smi {
+      let data_view: JSDataView = ValidateDataView(
+          context, receiver, 'get DataView.prototype.byte_length');
+      if (WasNeutered(data_view)) {
+        // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
+        // here if the JSArrayBuffer of the {data_view} was neutered.
+        let zero: Smi = 0;
+        return zero;
+      }
+      return data_view.byte_length;
+  }
+
+  // ES6 section 24.2.4.3 get DataView.prototype.byteOffset
+  javascript builtin DataViewPrototypeGetByteOffset(
+    context: Context, receiver: Object, ...arguments): Smi {
+      let data_view: JSDataView = ValidateDataView(
+          context, receiver, 'get DataView.prototype.byte_offset');
+      if (WasNeutered(data_view)) {
+        // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
+        // here if the JSArrayBuffer of the {data_view} was neutered.
+        let zero: Smi = 0;
+        return zero;
+      }
+      return data_view.byte_offset;
+  }
+
   // Context, receiver, byteOffset, littleEndian
   extern runtime DataViewGetInt8(Context, Object, Object, Object): Object;
   extern runtime DataViewGetUint8(Context, Object, Object, Object): Object;
@@ -16,7 +71,6 @@ module data_view {
   extern runtime DataViewGetBigInt64(Context, Object, Object, Object): Object;
   extern runtime DataViewGetBigUint64(Context, Object, Object, Object): Object;
 
-
   javascript builtin DataViewPrototypeGetInt8(
     context: Context, receiver: Object, ...arguments): Object {
       let offset: Object = arguments.length > 0 ?

src/code-stub-assembler.cc

@@ -5261,6 +5261,10 @@ TNode<BoolT> CodeStubAssembler::IsJSArrayBuffer(
   return HasInstanceType(object, JS_ARRAY_BUFFER_TYPE);
 }
 
+TNode<BoolT> CodeStubAssembler::IsJSDataView(TNode<HeapObject> object) {
+  return HasInstanceType(object, JS_DATA_VIEW_TYPE);
+}
+
 TNode<BoolT> CodeStubAssembler::IsFixedTypedArray(
     SloppyTNode<HeapObject> object) {
   TNode<Int32T> instance_type = LoadInstanceType(object);
@@ -11298,6 +11302,12 @@ Node* CodeStubAssembler::IsDetachedBuffer(Node* buffer) {
   return IsSetWord32<JSArrayBuffer::WasNeutered>(buffer_bit_field);
 }
 
+TNode<JSArrayBuffer> CodeStubAssembler::LoadArrayBufferViewBuffer(
+    TNode<JSArrayBufferView> array_buffer_view) {
+  return LoadObjectField<JSArrayBuffer>(array_buffer_view,
+                                        JSArrayBufferView::kBufferOffset);
+}
+
 CodeStubArguments::CodeStubArguments(
     CodeStubAssembler* assembler, Node* argc, Node* fp,
     CodeStubAssembler::ParameterMode param_mode, ReceiverMode receiver_mode)

src/code-stub-assembler.h

@@ -175,6 +175,13 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
     return UncheckedCast<JSArray>(heap_object);
   }
 
+  TNode<JSDataView> TaggedToJSDataView(TNode<Object> value, Label* fail) {
+    GotoIf(TaggedIsSmi(value), fail);
+    TNode<HeapObject> heap_object = CAST(value);
+    GotoIfNot(IsJSDataView(heap_object), fail);
+    return UncheckedCast<JSDataView>(heap_object);
+  }
+
   TNode<JSReceiver> TaggedToCallable(TNode<Object> value, Label* fail) {
     GotoIf(TaggedIsSmi(value), fail);
     TNode<HeapObject> result = UncheckedCast<HeapObject>(value);
@@ -1404,6 +1411,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<BoolT> IsHeapNumber(SloppyTNode<HeapObject> object);
   TNode<BoolT> IsIndirectStringInstanceType(SloppyTNode<Int32T> instance_type);
   TNode<BoolT> IsJSArrayBuffer(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSDataView(TNode<HeapObject> object);
   TNode<BoolT> IsJSArrayInstanceType(SloppyTNode<Int32T> instance_type);
   TNode<BoolT> IsJSArrayMap(SloppyTNode<Map> map);
   TNode<BoolT> IsJSArray(SloppyTNode<HeapObject> object);
@@ -2283,6 +2291,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   // TypedArray/ArrayBuffer helpers
   Node* IsDetachedBuffer(Node* buffer);
+  TNode<JSArrayBuffer> LoadArrayBufferViewBuffer(
+      TNode<JSArrayBufferView> array_buffer_view);
 
   TNode<IntPtrT> ElementOffsetFromIndex(Node* index, ElementsKind kind,
                                         ParameterMode mode, int base_size = 0);