diff --git a/src/hydrogen.cc b/src/hydrogen.cc index 57e63963c0..f52975434c 100644 --- a/src/hydrogen.cc +++ b/src/hydrogen.cc @@ -2465,19 +2465,21 @@ HInstruction* HGraphBuilder::BuildUncheckedMonomorphicElementAccess( length_checker.End(); return result; } else { + HValue* neuter_checked_object = checked_object; if (IsExternalArrayElementsKind(elements_kind)) { HInstruction* buffer = Add(checked_object, nullptr, HObjectAccess::ForJSArrayBufferViewBuffer()); HInstruction* buffer_length = Add( buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength()); - Add(graph()->GetConstant0(), buffer_length); + neuter_checked_object = + Add(graph()->GetConstant0(), buffer_length); } DCHECK(store_mode == STANDARD_STORE); checked_key = Add(key, length); - return AddElementAccess( - backing_store, checked_key, val, - checked_object, elements_kind, access_type); + return AddElementAccess(backing_store, checked_key, val, + neuter_checked_object, elements_kind, + access_type); } } DCHECK(fast_smi_only_elements || @@ -6340,8 +6342,16 @@ HValue* HOptimizedGraphBuilder::BuildMonomorphicAccess( if (info->GetJSArrayBufferViewFieldAccess(&access)) { DCHECK(info->IsLoad()); - return BuildArrayBufferViewFieldAccessor( - object, checked_object, FieldIndex::ForInObjectOffset(access.offset())); + HValue* neuter_checked_object = checked_object; + if (IsExternalArrayElementsKind(info->map()->elements_kind())) { + HInstruction* buffer = Add( + checked_object, nullptr, HObjectAccess::ForJSArrayBufferViewBuffer()); + HInstruction* buffer_length = Add( + buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength()); + neuter_checked_object = + Add(graph()->GetConstant0(), buffer_length); + } + return New(object, neuter_checked_object, access); } if (info->name().is_identical_to(isolate()->factory()->prototype_string()) &&