From 9f37b2f74b044b35a902f5901d25aa7779b6c3e3 Mon Sep 17 00:00:00 2001
From: Georg Neis <neis@chromium.org>
Date: Wed, 10 Apr 2019 16:27:45 +0200
Subject: [PATCH] [turbofan] Lift incorrect restriction in serializer

Bug: v8:7790
Change-Id: Iab5df5e0f387612dfdb1f68b34941e65fe8e256c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561314
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60815}
---
 .../serializer-for-background-compilation.cc  |  6 ++--
 test/mjsunit/compiler/typedarray-keyed.js     | 35 +++++++++++++++++++
 2 files changed, 37 insertions(+), 4 deletions(-)
 create mode 100644 test/mjsunit/compiler/typedarray-keyed.js

diff --git a/src/compiler/serializer-for-background-compilation.cc b/src/compiler/serializer-for-background-compilation.cc
index b39b82a041..3d9e11324c 100644
--- a/src/compiler/serializer-for-background-compilation.cc
+++ b/src/compiler/serializer-for-background-compilation.cc
@@ -825,10 +825,8 @@ void SerializerForBackgroundCompilation::ProcessKeyedPropertyAccess(
     ObjectRef receiver_ref(broker(), hint);
 
     // For JSNativeContextSpecialization::ReduceElementAccess.
-    if (mode == AccessMode::kStore) {
-      if (receiver_ref.IsJSTypedArray()) {
-        receiver_ref.AsJSTypedArray().Serialize();
-      }
+    if (receiver_ref.IsJSTypedArray()) {
+      receiver_ref.AsJSTypedArray().Serialize();
     }
 
     // For JSNativeContextSpecialization::ReduceKeyedLoadFromHeapConstant.
diff --git a/test/mjsunit/compiler/typedarray-keyed.js b/test/mjsunit/compiler/typedarray-keyed.js
new file mode 100644
index 0000000000..b7969d841d
--- /dev/null
+++ b/test/mjsunit/compiler/typedarray-keyed.js
@@ -0,0 +1,35 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Int8Array(100);
+
+function has(i) {
+  return i in a;
+}
+assertTrue(has(0));
+assertTrue(has(0));
+%OptimizeFunctionOnNextCall(has);
+assertTrue(has(0));
+assertTrue(has(1));
+
+function get(i) {
+  return a[i];
+}
+assertEquals(0, get(0));
+assertEquals(0, get(0));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(0, get(0));
+assertEquals(0, get(1));
+
+function set(i) {
+  const x = 42 + i;
+  return a[i] = x;
+}
+assertEquals(42, set(0)); assertEquals(42, a[0]);
+assertEquals(42, set(0)); assertEquals(42, a[0]);
+%OptimizeFunctionOnNextCall(set);
+assertEquals(42, set(0)); assertEquals(42, a[0]);
+assertEquals(43, set(1)); assertEquals(43, a[1]);