X87: [crankshaft] Loads and stores to typed arrays have to reference the backing store holder.

port 086d459847 (r32644)

  original commit message:
  The backing store is only held alive indirectly via the array buffer
  referenced by the holder (typed array), so it's not enough to keep the
  elements alive (or even just the external pointer loaded from the
  elements).

BUG=

Review URL: https://codereview.chromium.org/1503943002

Cr-Commit-Position: refs/heads/master@{#32648}
This commit is contained in:
zhengxing.li 2015-12-07 01:44:31 -08:00 committed by Commit bot
parent 4ff9bb070b
commit 5837db4171

View File

@ -2155,7 +2155,7 @@ class LStoreKeyed final : public LTemplateInstruction<0, 4, 0> {
inputs_[0] = obj;
inputs_[1] = key;
inputs_[2] = val;
inputs_[3] = backing_store_owner
inputs_[3] = backing_store_owner;
}
bool is_fixed_typed_array() const {