commit 9f37b2f74b044b35a902f5901d25aa7779b6c3e3
author Georg Neis <neis@chromium.org> Wed Apr 10 14:27:45 2019
committer Commit Bot <commit-bot@chromium.org> Fri Apr 12 12:43:54 2019
tree 6bb6244238b9994c92e52a98030376989ecb86fa
parent 3478f053d4e5eb11e891c0bb7e93c1b5a34ba5b3

[turbofan] Lift incorrect restriction in serializer

Bug: v8:7790
Change-Id: Iab5df5e0f387612dfdb1f68b34941e65fe8e256c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561314
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60815}

src/compiler/serializer-for-background-compilation.cc

diff --git a/src/compiler/serializer-for-background-compilation.cc b/src/compiler/serializer-for-background-compilation.cc
index b39b82a..3d9e113 100644
--- a/src/compiler/serializer-for-background-compilation.cc
+++ b/src/compiler/serializer-for-background-compilation.cc
@@ -825,10 +825,8 @@
     ObjectRef receiver_ref(broker(), hint);
 
     // For JSNativeContextSpecialization::ReduceElementAccess.
-    if (mode == AccessMode::kStore) {
-      if (receiver_ref.IsJSTypedArray()) {
-        receiver_ref.AsJSTypedArray().Serialize();
-      }
+    if (receiver_ref.IsJSTypedArray()) {
+      receiver_ref.AsJSTypedArray().Serialize();
     }
 
     // For JSNativeContextSpecialization::ReduceKeyedLoadFromHeapConstant.

test/mjsunit/compiler/typedarray-keyed.js

diff --git a/test/mjsunit/compiler/typedarray-keyed.js b/test/mjsunit/compiler/typedarray-keyed.js
new file mode 100644
index 0000000..b7969d8
--- /dev/null
+++ b/test/mjsunit/compiler/typedarray-keyed.js
@@ -0,0 +1,35 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Int8Array(100);
+
+function has(i) {
+  return i in a;
+}
+assertTrue(has(0));
+assertTrue(has(0));
+%OptimizeFunctionOnNextCall(has);
+assertTrue(has(0));
+assertTrue(has(1));
+
+function get(i) {
+  return a[i];
+}
+assertEquals(0, get(0));
+assertEquals(0, get(0));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(0, get(0));
+assertEquals(0, get(1));
+
+function set(i) {
+  const x = 42 + i;
+  return a[i] = x;
+}
+assertEquals(42, set(0)); assertEquals(42, a[0]);
+assertEquals(42, set(0)); assertEquals(42, a[0]);
+%OptimizeFunctionOnNextCall(set);
+assertEquals(42, set(0)); assertEquals(42, a[0]);
+assertEquals(43, set(1)); assertEquals(43, a[1]);