Revert of Make it possible to hoist the neutering check for TA property accesses...

Reason for revert:
[Sheriff] Breaks benchmarks:
http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/3403

Original issue's description:
> Make it possible to hoist the neutering check for TA property accesses
>
> Also correctly set up the dependency between propoerty and elements
> accesses and the checks
>
> BUG=v8:3996
> R=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/6a62e321381e1a212983804c4197068e842b240f
> Cr-Commit-Position: refs/heads/master@{#28087}

TBR=hpayer@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1108823003

Cr-Commit-Position: refs/heads/master@{#28088}

diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index f529754..57e6396 100644 (file)
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -2465,21 +2465,19 @@ HInstruction* HGraphBuilder::BuildUncheckedMonomorphicElementAccess(
       length_checker.End();
       return result;
     } else {
-      HValue* neuter_checked_object = checked_object;
       if (IsExternalArrayElementsKind(elements_kind)) {
         HInstruction* buffer =
             Add<HLoadNamedField>(checked_object, nullptr,
                                  HObjectAccess::ForJSArrayBufferViewBuffer());
         HInstruction* buffer_length = Add<HLoadNamedField>(
             buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
-        neuter_checked_object =
-            Add<HBoundsCheck>(graph()->GetConstant0(), buffer_length);
+        Add<HBoundsCheck>(graph()->GetConstant0(), buffer_length);
       }
       DCHECK(store_mode == STANDARD_STORE);
       checked_key = Add<HBoundsCheck>(key, length);
-      return AddElementAccess(backing_store, checked_key, val,
-                              neuter_checked_object, elements_kind,
-                              access_type);
+      return AddElementAccess(
+          backing_store, checked_key, val,
+          checked_object, elements_kind, access_type);
     }
   }
   DCHECK(fast_smi_only_elements ||
@@ -6342,16 +6340,8 @@ HValue* HOptimizedGraphBuilder::BuildMonomorphicAccess(
 
   if (info->GetJSArrayBufferViewFieldAccess(&access)) {
     DCHECK(info->IsLoad());
-    HValue* neuter_checked_object = checked_object;
-    if (IsExternalArrayElementsKind(info->map()->elements_kind())) {
-      HInstruction* buffer = Add<HLoadNamedField>(
-          checked_object, nullptr, HObjectAccess::ForJSArrayBufferViewBuffer());
-      HInstruction* buffer_length = Add<HLoadNamedField>(
-          buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
-      neuter_checked_object =
-          Add<HBoundsCheck>(graph()->GetConstant0(), buffer_length);
-    }
-    return New<HLoadNamedField>(object, neuter_checked_object, access);
+    return BuildArrayBufferViewFieldAccessor(
+        object, checked_object, FieldIndex::ForInObjectOffset(access.offset()));
   }
 
   if (info->name().is_identical_to(isolate()->factory()->prototype_string()) &&