[crankshaft] Loads and stores to typed arrays have to reference the backing store holder

src/crankshaft/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/crankshaft/hydrogen.h"
 
 #include <sstream>
 
 #include "src/allocation-site-scopes.h"
 #include "src/ast/ast-numbering.h"
@@ skipping 1354 matching lines @@
     new_length->ClearFlag(HValue::kCanOverflow);
 
     Add<HStoreNamedField>(object, HObjectAccess::ForArrayLength(kind),
                           new_length);
   }
 
   if (access_type == STORE && kind == FAST_SMI_ELEMENTS) {
     HValue* checked_elements = environment()->Top();
 
     // Write zero to ensure that the new element is initialized with some smi.
-    Add<HStoreKeyed>(checked_elements, key, graph()->GetConstant0(), kind);
+    Add<HStoreKeyed>(checked_elements, key, graph()->GetConstant0(), nullptr,
+                     kind);
   }
 
   length_checker.Else();
   Add<HBoundsCheck>(key, length);
 
   environment()->Push(elements);
   length_checker.End();
 
   return environment()->Pop();
 }
@@ skipping 283 matching lines @@
   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(16));
   return AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
 }
 
 
 HValue* HGraphBuilder::BuildUncheckedDictionaryElementLoad(
     HValue* receiver, HValue* elements, HValue* key, HValue* hash,
     LanguageMode language_mode) {
   HValue* capacity =
       Add<HLoadKeyed>(elements, Add<HConstant>(NameDictionary::kCapacityIndex),
-                      nullptr, FAST_ELEMENTS);
+                      nullptr, nullptr, FAST_ELEMENTS);
 
   HValue* mask = AddUncasted<HSub>(capacity, graph()->GetConstant1());
   mask->ChangeRepresentation(Representation::Integer32());
   mask->ClearFlag(HValue::kCanOverflow);
 
   HValue* entry = hash;
   HValue* count = graph()->GetConstant1();
   Push(entry);
   Push(count);
 
@@ skipping 10 matching lines @@
   entry = AddUncasted<HBitwise>(Token::BIT_AND, entry, mask);
   int entry_size = SeededNumberDictionary::kEntrySize;
   HValue* base_index = AddUncasted<HMul>(entry, Add<HConstant>(entry_size));
   base_index->ClearFlag(HValue::kCanOverflow);
   int start_offset = SeededNumberDictionary::kElementsStartIndex;
   HValue* key_index =
       AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset));
   key_index->ClearFlag(HValue::kCanOverflow);
 
   HValue* candidate_key =
-      Add<HLoadKeyed>(elements, key_index, nullptr, FAST_ELEMENTS);
+      Add<HLoadKeyed>(elements, key_index, nullptr, nullptr, FAST_ELEMENTS);
   IfBuilder if_undefined(this);
   if_undefined.If<HCompareObjectEqAndBranch>(candidate_key,
                                              graph()->GetConstantUndefined());
   if_undefined.Then();
   {
     // element == undefined means "not found". Call the runtime.
     // TODO(jkummerow): walk the prototype chain instead.
     Add<HPushArguments>(receiver, key);
     Push(Add<HCallRuntime>(
         Runtime::FunctionForId(is_strong(language_mode)
@@ skipping 22 matching lines @@
     if_update_with_internalized.If<HCompareNumericAndBranch>(
         not_internalized_bit, graph()->GetConstant0(), Token::NE);
     if_update_with_internalized.And();
     if_update_with_internalized.IfNot<HCompareObjectEqAndBranch>(
         candidate_key, graph()->GetConstantHole());
     if_update_with_internalized.AndIf<HStringCompareAndBranch>(candidate_key,
                                                                key, Token::EQ);
     if_update_with_internalized.Then();
     // Replace a key that is a non-internalized string by the equivalent
     // internalized string for faster further lookups.
-    Add<HStoreKeyed>(elements, key_index, key, FAST_ELEMENTS);
+    Add<HStoreKeyed>(elements, key_index, key, nullptr, FAST_ELEMENTS);
     if_update_with_internalized.Else();
 
     if_update_with_internalized.JoinContinuation(&found_key_match_continuation);
     if_match.JoinContinuation(&found_key_match_continuation);
 
     IfBuilder found_key_match(this, &found_key_match_continuation);
     found_key_match.Then();
     // Key at current probe matches. Relevant bits in the |details| field must
     // be zero, otherwise the dictionary element requires special handling.
     HValue* details_index =
         AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset + 2));
     details_index->ClearFlag(HValue::kCanOverflow);
-    HValue* details =
-        Add<HLoadKeyed>(elements, details_index, nullptr, FAST_ELEMENTS);
+    HValue* details = Add<HLoadKeyed>(elements, details_index, nullptr, nullptr,
+                                      FAST_ELEMENTS);
     int details_mask = PropertyDetails::TypeField::kMask;
     details = AddUncasted<HBitwise>(Token::BIT_AND, details,
                                     Add<HConstant>(details_mask));
     IfBuilder details_compare(this);
     details_compare.If<HCompareNumericAndBranch>(
         details, graph()->GetConstant0(), Token::EQ);
     details_compare.Then();
     HValue* result_index =
         AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset + 1));
     result_index->ClearFlag(HValue::kCanOverflow);
-    Push(Add<HLoadKeyed>(elements, result_index, nullptr, FAST_ELEMENTS));
+    Push(Add<HLoadKeyed>(elements, result_index, nullptr, nullptr,
+                         FAST_ELEMENTS));
     details_compare.Else();
     Add<HPushArguments>(receiver, key);
     Push(Add<HCallRuntime>(
         Runtime::FunctionForId(is_strong(language_mode)
                                    ? Runtime::kKeyedGetPropertyStrong
                                    : Runtime::kKeyedGetProperty),
         2));
     details_compare.End();
 
     found_key_match.Else();
@@ skipping 149 matching lines @@
   IfBuilder if_objectissmi(this);
   if_objectissmi.If<HIsSmiAndBranch>(object);
   if_objectissmi.Then();
   {
     // Compute hash for smi similar to smi_get_hash().
     HValue* hash = AddUncasted<HBitwise>(Token::BIT_AND, object, mask);
 
     // Load the key.
     HValue* key_index = AddUncasted<HShl>(hash, graph()->GetConstant1());
     HValue* key = Add<HLoadKeyed>(number_string_cache, key_index, nullptr,
-                                  FAST_ELEMENTS, ALLOW_RETURN_HOLE);
+                                  nullptr, FAST_ELEMENTS, ALLOW_RETURN_HOLE);
 
     // Check if object == key.
     IfBuilder if_objectiskey(this);
     if_objectiskey.If<HCompareObjectEqAndBranch>(object, key);
     if_objectiskey.Then();
     {
       // Make the key_index available.
       Push(key_index);
     }
     if_objectiskey.JoinContinuation(&found);
@@ skipping 14 matching lines @@
             object, objectisnumber,
             HObjectAccess::ForHeapNumberValueLowestBits());
         HValue* high = Add<HLoadNamedField>(
             object, objectisnumber,
             HObjectAccess::ForHeapNumberValueHighestBits());
         HValue* hash = AddUncasted<HBitwise>(Token::BIT_XOR, low, high);
         hash = AddUncasted<HBitwise>(Token::BIT_AND, hash, mask);
 
         // Load the key.
         HValue* key_index = AddUncasted<HShl>(hash, graph()->GetConstant1());
-        HValue* key = Add<HLoadKeyed>(number_string_cache, key_index, nullptr,
-                                      FAST_ELEMENTS, ALLOW_RETURN_HOLE);
+        HValue* key =
+            Add<HLoadKeyed>(number_string_cache, key_index, nullptr, nullptr,
+                            FAST_ELEMENTS, ALLOW_RETURN_HOLE);
 
         // Check if the key is a heap number and compare it with the object.
         IfBuilder if_keyisnotsmi(this);
         HValue* keyisnotsmi = if_keyisnotsmi.IfNot<HIsSmiAndBranch>(key);
         if_keyisnotsmi.Then();
         {
           IfBuilder if_keyisheapnumber(this);
           if_keyisheapnumber.If<HCompareMap>(
               key, isolate()->factory()->heap_number_map());
           if_keyisheapnumber.Then();
@@ skipping 31 matching lines @@
   // Check for cache hit.
   IfBuilder if_found(this, &found);
   if_found.Then();
   {
     // Count number to string operation in native code.
     AddIncrementCounter(isolate()->counters()->number_to_string_native());
 
     // Load the value in case of cache hit.
     HValue* key_index = Pop();
     HValue* value_index = AddUncasted<HAdd>(key_index, graph()->GetConstant1());
-    Push(Add<HLoadKeyed>(number_string_cache, value_index, nullptr,
+    Push(Add<HLoadKeyed>(number_string_cache, value_index, nullptr, nullptr,
                          FAST_ELEMENTS, ALLOW_RETURN_HOLE));
   }
   if_found.Else();
   {
     // Cache miss, fallback to runtime.
     Add<HPushArguments>(object);
     Push(Add<HCallRuntime>(
             Runtime::FunctionForId(Runtime::kNumberToStringSkipCache),
             1));
   }
@@ skipping 63 matching lines @@
   if_wrap.Then();
   {
     // Grab the constructor function index.
     HValue* constructor_index = Pop();
 
     // Load native context.
     HValue* native_context = BuildGetNativeContext();
 
     // Determine the initial map for the global constructor.
     HValue* constructor = Add<HLoadKeyed>(native_context, constructor_index,
-                                          nullptr, FAST_ELEMENTS);
+                                          nullptr, nullptr, FAST_ELEMENTS);
     HValue* constructor_initial_map = Add<HLoadNamedField>(
         constructor, nullptr, HObjectAccess::ForPrototypeOrInitialMap());
     // Allocate and initialize a JSValue wrapper.
     HValue* value =
         BuildAllocate(Add<HConstant>(JSValue::kSize), HType::JSObject(),
                       JS_VALUE_TYPE, HAllocationMode());
     Add<HStoreNamedField>(value, HObjectAccess::ForMap(),
                           constructor_initial_map);
     HValue* empty_fixed_array = Add<HLoadRoot>(Heap::kEmptyFixedArrayRootIndex);
     Add<HStoreNamedField>(value, HObjectAccess::ForPropertiesPointer(),
@@ skipping 450 matching lines @@
     if (store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
       NoObservableSideEffectsScope no_effects(this);
       IfBuilder length_checker(this);
       length_checker.If<HCompareNumericAndBranch>(key, length, Token::LT);
       length_checker.Then();
       IfBuilder negative_checker(this);
       HValue* bounds_check = negative_checker.If<HCompareNumericAndBranch>(
           key, graph()->GetConstant0(), Token::GTE);
       negative_checker.Then();
       HInstruction* result = AddElementAccess(
-          backing_store, key, val, bounds_check, elements_kind, access_type);
+          backing_store, key, val, bounds_check, checked_object->ActualValue(),
+          elements_kind, access_type);
       negative_checker.ElseDeopt(Deoptimizer::kNegativeKeyEncountered);
       negative_checker.End();
       length_checker.End();
       return result;
     } else {
       DCHECK(store_mode == STANDARD_STORE);
       checked_key = Add<HBoundsCheck>(key, length);
-      return AddElementAccess(
-          backing_store, checked_key, val,
-          checked_object, elements_kind, access_type);
+      return AddElementAccess(backing_store, checked_key, val, checked_object,
+                              checked_object->ActualValue(), elements_kind,
+                              access_type);
     }
   }
   DCHECK(fast_smi_only_elements ||
          fast_elements ||
          IsFastDoubleElementsKind(elements_kind));
 
   // In case val is stored into a fast smi array, assure that the value is a smi
   // before manipulating the backing store. Otherwise the actual store may
   // deopt, leaving the backing store in an invalid state.
   if (access_type == STORE && IsFastSmiElementsKind(elements_kind) &&
@@ skipping 18 matching lines @@
         NoObservableSideEffectsScope no_effects(this);
         elements = BuildCopyElementsOnWrite(checked_object, elements,
                                             elements_kind, length);
       } else {
         HCheckMaps* check_cow_map = Add<HCheckMaps>(
             elements, isolate()->factory()->fixed_array_map());
         check_cow_map->ClearDependsOnFlag(kElementsKind);
       }
     }
   }
-  return AddElementAccess(elements, checked_key, val, checked_object,
+  return AddElementAccess(elements, checked_key, val, checked_object, nullptr,
                           elements_kind, access_type, load_mode);
 }
 
 
 HValue* HGraphBuilder::BuildAllocateArrayFromLength(
     JSArrayBuilder* array_builder,
     HValue* length_argument) {
   if (length_argument->IsConstant() &&
       HConstant::cast(length_argument)->HasSmiValue()) {
     int array_length = HConstant::cast(length_argument)->Integer32Value();
@@ skipping 142 matching lines @@
       array, HObjectAccess::ForArrayLength(elements_kind), length_field);
 
   if (mode == TRACK_ALLOCATION_SITE) {
     BuildCreateAllocationMemento(
         array, Add<HConstant>(JSArray::kSize), allocation_site_payload);
   }
 }
 
 
 HInstruction* HGraphBuilder::AddElementAccess(
-    HValue* elements,
-    HValue* checked_key,
-    HValue* val,
-    HValue* dependency,
-    ElementsKind elements_kind,
-    PropertyAccessType access_type,
-    LoadKeyedHoleMode load_mode) {
+    HValue* elements, HValue* checked_key, HValue* val, HValue* dependency,
+    HValue* backing_store_owner, ElementsKind elements_kind,
+    PropertyAccessType access_type, LoadKeyedHoleMode load_mode) {
   if (access_type == STORE) {
     DCHECK(val != NULL);
     if (elements_kind == UINT8_CLAMPED_ELEMENTS) {
       val = Add<HClampToUint8>(val);
     }
-    return Add<HStoreKeyed>(elements, checked_key, val, elements_kind,
-                            STORE_TO_INITIALIZED_ENTRY);
+    return Add<HStoreKeyed>(elements, checked_key, val, backing_store_owner,
+                            elements_kind, STORE_TO_INITIALIZED_ENTRY);
   }
 
   DCHECK(access_type == LOAD);
   DCHECK(val == NULL);
-  HLoadKeyed* load = Add<HLoadKeyed>(
-      elements, checked_key, dependency, elements_kind, load_mode);
+  HLoadKeyed* load =
+      Add<HLoadKeyed>(elements, checked_key, dependency, backing_store_owner,
+                      elements_kind, load_mode);
   if (elements_kind == UINT32_ELEMENTS) {
     graph()->RecordUint32Instruction(load);
   }
   return load;
 }
 
 
 HLoadNamedField* HGraphBuilder::AddLoadMap(HValue* object,
                                            HValue* dependency) {
   return Add<HLoadNamedField>(object, dependency, HObjectAccess::ForMap());
@@ skipping 80 matching lines @@
     int constant_to = to->GetInteger32Constant();
 
     if (constant_from == 0 && constant_to <= kElementLoopUnrollThreshold) {
       initial_capacity = constant_to;
     }
   }
 
   if (initial_capacity >= 0) {
     for (int i = 0; i < initial_capacity; i++) {
       HInstruction* key = Add<HConstant>(i);
-      Add<HStoreKeyed>(elements, key, value, elements_kind);
+      Add<HStoreKeyed>(elements, key, value, nullptr, elements_kind);
     }
   } else {
     // Carefully loop backwards so that the "from" remains live through the loop
     // rather than the to. This often corresponds to keeping length live rather
     // then capacity, which helps register allocation, since length is used more
     // other than capacity after filling with holes.
     LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
 
     HValue* key = builder.BeginBody(to, from, Token::GT);
 
     HValue* adjusted_key = AddUncasted<HSub>(key, graph()->GetConstant1());
     adjusted_key->ClearFlag(HValue::kCanOverflow);
 
-    Add<HStoreKeyed>(elements, adjusted_key, value, elements_kind);
+    Add<HStoreKeyed>(elements, adjusted_key, value, nullptr, elements_kind);
 
     builder.EndBody();
   }
 }
 
 
 void HGraphBuilder::BuildFillElementsWithHole(HValue* elements,
                                               ElementsKind elements_kind,
                                               HValue* from,
                                               HValue* to) {
@@ skipping 22 matching lines @@
   BuildFillElementsWithValue(to_properties, kind, length, capacity,
                              graph()->GetConstantUndefined());
 
   LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
 
   HValue* key = builder.BeginBody(length, graph()->GetConstant0(), Token::GT);
 
   key = AddUncasted<HSub>(key, graph()->GetConstant1());
   key->ClearFlag(HValue::kCanOverflow);
 
-  HValue* element = Add<HLoadKeyed>(from_properties, key, nullptr, kind);
+  HValue* element =
+      Add<HLoadKeyed>(from_properties, key, nullptr, nullptr, kind);
 
-  Add<HStoreKeyed>(to_properties, key, element, kind);
+  Add<HStoreKeyed>(to_properties, key, element, nullptr, kind);
 
   builder.EndBody();
 }
 
 
 void HGraphBuilder::BuildCopyElements(HValue* from_elements,
                                       ElementsKind from_elements_kind,
                                       HValue* to_elements,
                                       ElementsKind to_elements_kind,
                                       HValue* length,
@@ skipping 16 matching lines @@
     // pre-initialized with holes to make sure that it's always in a
     // consistent state.
     BuildFillElementsWithHole(to_elements, to_elements_kind,
                               graph()->GetConstant0(), NULL);
   }
 
   if (constant_capacity != -1) {
     // Unroll the loop for small elements kinds.
     for (int i = 0; i < constant_capacity; i++) {
       HValue* key_constant = Add<HConstant>(i);
-      HInstruction* value = Add<HLoadKeyed>(from_elements, key_constant,
-                                            nullptr, from_elements_kind);
-      Add<HStoreKeyed>(to_elements, key_constant, value, to_elements_kind);
+      HInstruction* value = Add<HLoadKeyed>(
+          from_elements, key_constant, nullptr, nullptr, from_elements_kind);
+      Add<HStoreKeyed>(to_elements, key_constant, value, nullptr,
+                       to_elements_kind);
     }
   } else {
     if (!pre_fill_with_holes &&
         (capacity == NULL || !length->Equals(capacity))) {
       BuildFillElementsWithHole(to_elements, to_elements_kind,
                                 length, NULL);
     }
 
     LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
 
     HValue* key = builder.BeginBody(length, graph()->GetConstant0(),
                                     Token::GT);
 
     key = AddUncasted<HSub>(key, graph()->GetConstant1());
     key->ClearFlag(HValue::kCanOverflow);
 
-    HValue* element = Add<HLoadKeyed>(from_elements, key, nullptr,
+    HValue* element = Add<HLoadKeyed>(from_elements, key, nullptr, nullptr,
                                       from_elements_kind, ALLOW_RETURN_HOLE);
 
     ElementsKind kind = (IsHoleyElementsKind(from_elements_kind) &&
                          IsFastSmiElementsKind(to_elements_kind))
       ? FAST_HOLEY_ELEMENTS : to_elements_kind;
 
     if (IsHoleyElementsKind(from_elements_kind) &&
         from_elements_kind != to_elements_kind) {
       IfBuilder if_hole(this);
       if_hole.If<HCompareHoleAndBranch>(element);
       if_hole.Then();
       HConstant* hole_constant = IsFastDoubleElementsKind(to_elements_kind)
                                      ? Add<HConstant>(HConstant::kHoleNaN)
                                      : graph()->GetConstantHole();
-      Add<HStoreKeyed>(to_elements, key, hole_constant, kind);
+      Add<HStoreKeyed>(to_elements, key, hole_constant, nullptr, kind);
       if_hole.Else();
-      HStoreKeyed* store = Add<HStoreKeyed>(to_elements, key, element, kind);
+      HStoreKeyed* store =
+          Add<HStoreKeyed>(to_elements, key, element, nullptr, kind);
       store->SetFlag(HValue::kAllowUndefinedAsNaN);
       if_hole.End();
     } else {
-      HStoreKeyed* store = Add<HStoreKeyed>(to_elements, key, element, kind);
+      HStoreKeyed* store =
+          Add<HStoreKeyed>(to_elements, key, element, nullptr, kind);
       store->SetFlag(HValue::kAllowUndefinedAsNaN);
     }
 
     builder.EndBody();
   }
 
   Counters* counters = isolate()->counters();
   AddIncrementCounter(counters->inlined_copied_elements());
 }
 
@@ skipping 259 matching lines @@
     }
   }
   return script_context;
 }
 
 
 HInstruction* HGraphBuilder::BuildGetArrayFunction() {
   HInstruction* native_context = BuildGetNativeContext();
   HInstruction* index =
       Add<HConstant>(static_cast<int32_t>(Context::ARRAY_FUNCTION_INDEX));
-  return Add<HLoadKeyed>(native_context, index, nullptr, FAST_ELEMENTS);
+  return Add<HLoadKeyed>(native_context, index, nullptr, nullptr,
+                         FAST_ELEMENTS);
 }
 
 
 HValue* HGraphBuilder::BuildArrayBufferViewFieldAccessor(HValue* object,
                                                          HValue* checked_object,
                                                          FieldIndex index) {
   NoObservableSideEffectsScope scope(this);
   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
       index.offset(), Representation::Tagged());
   HInstruction* buffer = Add<HLoadNamedField>(
@@ skipping 67 matching lines @@
 
   // TODO(mvstanton): we should always have a constructor function if we
   // are creating a stub.
   HInstruction* native_context = constructor_function_ != NULL
       ? builder()->BuildGetNativeContext(constructor_function_)
       : builder()->BuildGetNativeContext();
 
   HInstruction* index = builder()->Add<HConstant>(
       static_cast<int32_t>(Context::JS_ARRAY_MAPS_INDEX));
 
-  HInstruction* map_array =
-      builder()->Add<HLoadKeyed>(native_context, index, nullptr, FAST_ELEMENTS);
+  HInstruction* map_array = builder()->Add<HLoadKeyed>(
+      native_context, index, nullptr, nullptr, FAST_ELEMENTS);
 
   HInstruction* kind_index = builder()->Add<HConstant>(kind_);
 
-  return builder()->Add<HLoadKeyed>(map_array, kind_index, nullptr,
+  return builder()->Add<HLoadKeyed>(map_array, kind_index, nullptr, nullptr,
                                     FAST_ELEMENTS);
 }
 
 
 HValue* HGraphBuilder::JSArrayBuilder::EmitInternalMapCode() {
   // Find the map near the constructor function
   HObjectAccess access = HObjectAccess::ForPrototypeOrInitialMap();
   return builder()->Add<HLoadNamedField>(constructor_function_, nullptr,
                                          access);
 }
@@ skipping 1929 matching lines @@
   compare_index->SetSuccessorAt(1, loop_successor);
   FinishCurrentBlock(compare_index);
 
   set_current_block(loop_successor);
   Drop(5);
 
   set_current_block(loop_body);
 
   HValue* key =
       Add<HLoadKeyed>(environment()->ExpressionStackAt(2),  // Enum cache.
-                      index, index, FAST_ELEMENTS);
+                      index, index, nullptr, FAST_ELEMENTS);
 
   if (fast) {
     // Check if the expected map still matches that of the enumerable.
     // If not just deoptimize.
     Add<HCheckMapValue>(enumerable, environment()->ExpressionStackAt(3));
     Bind(each_var, key);
   } else {
     Add<HPushArguments>(enumerable, key);
     Runtime::FunctionId function_id = Runtime::kForInFilter;
     key = Add<HCallRuntime>(Runtime::FunctionForId(function_id), 2);
@@ skipping 687 matching lines @@
 
     HValue* key = Add<HConstant>(i);
 
     switch (boilerplate_elements_kind) {
       case FAST_SMI_ELEMENTS:
       case FAST_HOLEY_SMI_ELEMENTS:
       case FAST_ELEMENTS:
       case FAST_HOLEY_ELEMENTS:
       case FAST_DOUBLE_ELEMENTS:
       case FAST_HOLEY_DOUBLE_ELEMENTS: {
-        HStoreKeyed* instr = Add<HStoreKeyed>(elements, key, value,
+        HStoreKeyed* instr = Add<HStoreKeyed>(elements, key, value, nullptr,
                                               boilerplate_elements_kind);
         instr->SetUninitialized(uninitialized);
         break;
       }
       default:
         UNREACHABLE();
         break;
     }
 
     Add<HSimulate>(expr->GetIdForElement(i));
@@ skipping 2742 matching lines @@
         if (!ast_context()->IsEffect()) Push(graph()->GetConstantUndefined());
 
         length_checker.Else();
         HValue* elements = AddLoadElements(checked_object);
         // Ensure that we aren't popping from a copy-on-write array.
         if (IsFastSmiOrObjectElementsKind(elements_kind)) {
           elements = BuildCopyElementsOnWrite(checked_object, elements,
                                               elements_kind, length);
         }
         reduced_length = AddUncasted<HSub>(length, graph()->GetConstant1());
-        result = AddElementAccess(elements, reduced_length, NULL,
-                                  bounds_check, elements_kind, LOAD);
+        result = AddElementAccess(elements, reduced_length, nullptr,
+                                  bounds_check, nullptr, elements_kind, LOAD);
         HValue* hole = IsFastSmiOrObjectElementsKind(elements_kind)
                            ? graph()->GetConstantHole()
                            : Add<HConstant>(HConstant::kHoleNaN);
         if (IsFastSmiOrObjectElementsKind(elements_kind)) {
           elements_kind = FAST_HOLEY_ELEMENTS;
         }
-        AddElementAccess(
-            elements, reduced_length, hole, bounds_check, elements_kind, STORE);
+        AddElementAccess(elements, reduced_length, hole, bounds_check, nullptr,
+                         elements_kind, STORE);
         Add<HStoreNamedField>(
             checked_object, HObjectAccess::ForArrayLength(elements_kind),
             reduced_length, STORE_TO_INITIALIZED_ENTRY);
 
         if (!ast_context()->IsEffect()) Push(result);
 
         length_checker.End();
       }
       result = ast_context()->IsEffect() ? graph()->GetConstant0() : Top();
       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
@@ skipping 104 matching lines @@
               length, inline_threshold, Token::LTE);
           if (IsFastSmiOrObjectElementsKind(kind)) {
             // We cannot handle copy-on-write backing stores here.
             if_inline.AndIf<HCompareMap>(
                 elements, isolate()->factory()->fixed_array_map());
           }
           if_inline.Then();
           {
             // Remember the result.
             if (!ast_context()->IsEffect()) {
-              Push(AddElementAccess(elements, graph()->GetConstant0(), NULL,
-                                    lengthiszero, kind, LOAD));
+              Push(AddElementAccess(elements, graph()->GetConstant0(), nullptr,
+                                    lengthiszero, nullptr, kind, LOAD));
             }
 
             // Compute the new length.
             HValue* new_length = AddUncasted<HSub>(
                 length, graph()->GetConstant1());
             new_length->ClearFlag(HValue::kCanOverflow);
 
             // Copy the remaining elements.
             LoopBuilder loop(this, context(), LoopBuilder::kPostIncrement);
             {
               HValue* new_key = loop.BeginBody(
                   graph()->GetConstant0(), new_length, Token::LT);
               HValue* key = AddUncasted<HAdd>(new_key, graph()->GetConstant1());
               key->ClearFlag(HValue::kCanOverflow);
               ElementsKind copy_kind =
                   kind == FAST_HOLEY_SMI_ELEMENTS ? FAST_HOLEY_ELEMENTS : kind;
-              HValue* element = AddUncasted<HLoadKeyed>(
-                  elements, key, lengthiszero, copy_kind, ALLOW_RETURN_HOLE);
-              HStoreKeyed* store =
-                  Add<HStoreKeyed>(elements, new_key, element, copy_kind);
+              HValue* element =
+                  AddUncasted<HLoadKeyed>(elements, key, lengthiszero, nullptr,
+                                          copy_kind, ALLOW_RETURN_HOLE);
+              HStoreKeyed* store = Add<HStoreKeyed>(elements, new_key, element,
+                                                    nullptr, copy_kind);
               store->SetFlag(HValue::kAllowUndefinedAsNaN);
             }
             loop.EndBody();
 
             // Put a hole at the end.
             HValue* hole = IsFastSmiOrObjectElementsKind(kind)
                                ? graph()->GetConstantHole()
                                : Add<HConstant>(HConstant::kHoleNaN);
             if (IsFastSmiOrObjectElementsKind(kind)) kind = FAST_HOLEY_ELEMENTS;
-            Add<HStoreKeyed>(
-                elements, new_length, hole, kind, INITIALIZING_STORE);
+            Add<HStoreKeyed>(elements, new_length, hole, nullptr, kind,
+                             INITIALIZING_STORE);
 
             // Remember new length.
             Add<HStoreNamedField>(
                 receiver, HObjectAccess::ForArrayLength(kind),
                 new_length, STORE_TO_INITIALIZED_ENTRY);
           }
           if_inline.Else();
           {
             Add<HPushArguments>(receiver);
             result = Add<HCallJSFunction>(function, 1);
@@ skipping 441 matching lines @@
   if (IsFastDoubleElementsKind(kind) || IsFastSmiElementsKind(kind)) {
     // Make sure that we can actually compare numbers correctly below, see
     // https://code.google.com/p/chromium/issues/detail?id=407946 for details.
     search_element = AddUncasted<HForceRepresentation>(
         search_element, IsFastSmiElementsKind(kind) ? Representation::Smi()
                                                     : Representation::Double());
 
     LoopBuilder loop(this, context(), direction);
     {
       HValue* index = loop.BeginBody(initial, terminating, token);
-      HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr, kind,
-                                                ALLOW_RETURN_HOLE);
+      HValue* element = AddUncasted<HLoadKeyed>(
+          elements, index, nullptr, nullptr, kind, ALLOW_RETURN_HOLE);
       IfBuilder if_issame(this);
       if_issame.If<HCompareNumericAndBranch>(element, search_element,
                                              Token::EQ_STRICT);
       if_issame.Then();
       {
         Drop(1);
         Push(index);
         loop.Break();
       }
       if_issame.End();
     }
     loop.EndBody();
   } else {
     IfBuilder if_isstring(this);
     if_isstring.If<HIsStringAndBranch>(search_element);
     if_isstring.Then();
     {
       LoopBuilder loop(this, context(), direction);
       {
         HValue* index = loop.BeginBody(initial, terminating, token);
-        HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
-                                                  kind, ALLOW_RETURN_HOLE);
+        HValue* element = AddUncasted<HLoadKeyed>(
+            elements, index, nullptr, nullptr, kind, ALLOW_RETURN_HOLE);
         IfBuilder if_issame(this);
         if_issame.If<HIsStringAndBranch>(element);
         if_issame.AndIf<HStringCompareAndBranch>(
             element, search_element, Token::EQ_STRICT);
         if_issame.Then();
         {
           Drop(1);
           Push(index);
           loop.Break();
         }
         if_issame.End();
       }
       loop.EndBody();
     }
     if_isstring.Else();
     {
       IfBuilder if_isnumber(this);
       if_isnumber.If<HIsSmiAndBranch>(search_element);
       if_isnumber.OrIf<HCompareMap>(
           search_element, isolate()->factory()->heap_number_map());
       if_isnumber.Then();
       {
         HValue* search_number =
             AddUncasted<HForceRepresentation>(search_element,
                                               Representation::Double());
         LoopBuilder loop(this, context(), direction);
         {
           HValue* index = loop.BeginBody(initial, terminating, token);
-          HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
-                                                    kind, ALLOW_RETURN_HOLE);
+          HValue* element = AddUncasted<HLoadKeyed>(
+              elements, index, nullptr, nullptr, kind, ALLOW_RETURN_HOLE);
 
           IfBuilder if_element_isnumber(this);
           if_element_isnumber.If<HIsSmiAndBranch>(element);
           if_element_isnumber.OrIf<HCompareMap>(
               element, isolate()->factory()->heap_number_map());
           if_element_isnumber.Then();
           {
             HValue* number =
                 AddUncasted<HForceRepresentation>(element,
                                                   Representation::Double());
@@ skipping 10 matching lines @@
           }
           if_element_isnumber.End();
         }
         loop.EndBody();
       }
       if_isnumber.Else();
       {
         LoopBuilder loop(this, context(), direction);
         {
           HValue* index = loop.BeginBody(initial, terminating, token);
-          HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
-                                                    kind, ALLOW_RETURN_HOLE);
+          HValue* element = AddUncasted<HLoadKeyed>(
+              elements, index, nullptr, nullptr, kind, ALLOW_RETURN_HOLE);
           IfBuilder if_issame(this);
           if_issame.If<HCompareObjectEqAndBranch>(
               element, search_element);
           if_issame.Then();
           {
             Drop(1);
             Push(index);
             loop.Break();
           }
           if_issame.End();
@@ skipping 635 matching lines @@
   if (initialize) {
     LoopBuilder builder(this, context(), LoopBuilder::kPostIncrement);
 
     HValue* backing_store = AddUncasted<HAdd>(
         Add<HConstant>(ExternalReference::fixed_typed_array_base_data_offset()),
         elements, Strength::WEAK, AddOfExternalAndTagged);
 
     HValue* key = builder.BeginBody(
         Add<HConstant>(static_cast<int32_t>(0)),
         length, Token::LT);
-    Add<HStoreKeyed>(backing_store, key, filler, fixed_elements_kind);
+    Add<HStoreKeyed>(backing_store, key, filler, elements, fixed_elements_kind);
 
     builder.EndBody();
   }
   return elements;
 }
 
 
 void HOptimizedGraphBuilder::GenerateTypedArrayInitialize(
     CallRuntime* expr) {
   ZoneList<Expression*>* arguments = expr->arguments();
@@ skipping 1722 matching lines @@
 
 
 void HOptimizedGraphBuilder::BuildEmitFixedDoubleArray(
     Handle<FixedArrayBase> elements,
     ElementsKind kind,
     HValue* object_elements) {
   HInstruction* boilerplate_elements = Add<HConstant>(elements);
   int elements_length = elements->length();
   for (int i = 0; i < elements_length; i++) {
     HValue* key_constant = Add<HConstant>(i);
-    HInstruction* value_instruction = Add<HLoadKeyed>(
-        boilerplate_elements, key_constant, nullptr, kind, ALLOW_RETURN_HOLE);
+    HInstruction* value_instruction =
+        Add<HLoadKeyed>(boilerplate_elements, key_constant, nullptr, nullptr,
+                        kind, ALLOW_RETURN_HOLE);
     HInstruction* store = Add<HStoreKeyed>(object_elements, key_constant,
-                                           value_instruction, kind);
+                                           value_instruction, nullptr, kind);
     store->SetFlag(HValue::kAllowUndefinedAsNaN);
   }
 }
 
 
 void HOptimizedGraphBuilder::BuildEmitFixedArray(
     Handle<FixedArrayBase> elements,
     ElementsKind kind,
     HValue* object_elements,
     AllocationSiteUsageContext* site_context) {
   HInstruction* boilerplate_elements = Add<HConstant>(elements);
   int elements_length = elements->length();
   Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
   for (int i = 0; i < elements_length; i++) {
     Handle<Object> value(fast_elements->get(i), isolate());
     HValue* key_constant = Add<HConstant>(i);
     if (value->IsJSObject()) {
       Handle<JSObject> value_object = Handle<JSObject>::cast(value);
       Handle<AllocationSite> current_site = site_context->EnterNewScope();
       HInstruction* result =
           BuildFastLiteral(value_object, site_context);
       site_context->ExitScope(current_site, value_object);
-      Add<HStoreKeyed>(object_elements, key_constant, result, kind);
+      Add<HStoreKeyed>(object_elements, key_constant, result, nullptr, kind);
     } else {
       ElementsKind copy_kind =
           kind == FAST_HOLEY_SMI_ELEMENTS ? FAST_HOLEY_ELEMENTS : kind;
       HInstruction* value_instruction =
-          Add<HLoadKeyed>(boilerplate_elements, key_constant, nullptr,
+          Add<HLoadKeyed>(boilerplate_elements, key_constant, nullptr, nullptr,
                           copy_kind, ALLOW_RETURN_HOLE);
       Add<HStoreKeyed>(object_elements, key_constant, value_instruction,
-                       copy_kind);
+                       nullptr, copy_kind);
     }
   }
 }
 
 
 void HOptimizedGraphBuilder::VisitThisFunction(ThisFunction* expr) {
   DCHECK(!HasStackOverflow());
   DCHECK(current_block() != NULL);
   DCHECK(current_block()->HasPredecessor());
   HInstruction* instr = BuildThisFunction();
@@ skipping 752 matching lines @@
 }
 
 
 void HOptimizedGraphBuilder::GenerateFixedArrayGet(CallRuntime* call) {
   DCHECK(call->arguments()->length() == 2);
   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
   HValue* index = Pop();
   HValue* object = Pop();
   HInstruction* result = New<HLoadKeyed>(
-      object, index, nullptr, FAST_HOLEY_ELEMENTS, ALLOW_RETURN_HOLE);
+      object, index, nullptr, nullptr, FAST_HOLEY_ELEMENTS, ALLOW_RETURN_HOLE);
   return ast_context()->ReturnInstruction(result, call->id());
 }
 
 
 void HOptimizedGraphBuilder::GenerateFixedArraySet(CallRuntime* call) {
   DCHECK(call->arguments()->length() == 3);
   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
   HValue* value = Pop();
   HValue* index = Pop();
   HValue* object = Pop();
   NoObservableSideEffectsScope no_effects(this);
-  Add<HStoreKeyed>(object, index, value, FAST_HOLEY_ELEMENTS);
+  Add<HStoreKeyed>(object, index, value, nullptr, FAST_HOLEY_ELEMENTS);
   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
 }
 
 
 void HOptimizedGraphBuilder::GenerateTheHole(CallRuntime* call) {
   DCHECK(call->arguments()->length() == 0);
   return ast_context()->ReturnValue(graph()->GetConstantHole());
 }
 
 
@@ skipping 815 matching lines @@
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8