[crankshaft] Loads and stores to typed arrays have to reference the backing store holder

src/crankshaft/ia32/lithium-ia32.h

Index: src/crankshaft/ia32/lithium-ia32.h
diff --git a/src/crankshaft/ia32/lithium-ia32.h b/src/crankshaft/ia32/lithium-ia32.h
index 1020828062d5c49d82a1b16af879d13d1c086ae4..f22fac379b5f0b03eec780bacaec8a67d033e23e 100644
--- a/src/crankshaft/ia32/lithium-ia32.h
+++ b/src/crankshaft/ia32/lithium-ia32.h
@@ -1590,14 +1590,16 @@ class LLoadRoot final : public LTemplateInstruction<1, 0, 0> {
 };
 
 
-class LLoadKeyed final : public LTemplateInstruction<1, 2, 0> {
+class LLoadKeyed final : public LTemplateInstruction<1, 3, 0> {
  public:
-  LLoadKeyed(LOperand* elements, LOperand* key) {
+  LLoadKeyed(LOperand* elements, LOperand* key, LOperand* backing_store_owner) {
     inputs_[0] = elements;
     inputs_[1] = key;
+    inputs_[2] = backing_store_owner;
   }
   LOperand* elements() { return inputs_[0]; }
   LOperand* key() { return inputs_[1]; }
+  LOperand* backing_store_owner() { return inputs_[2]; }
   ElementsKind elements_kind() const {
     return hydrogen()->elements_kind();
   }
@@ -2142,12 +2144,14 @@ class LStoreNamedGeneric final : public LTemplateInstruction<0, 3, 2> {
 };
 
 
-class LStoreKeyed final : public LTemplateInstruction<0, 3, 0> {
+class LStoreKeyed final : public LTemplateInstruction<0, 4, 0> {
  public:
-  LStoreKeyed(LOperand* obj, LOperand* key, LOperand* val) {
+  LStoreKeyed(LOperand* obj, LOperand* key, LOperand* val,
+              LOperand* backing_store_owner) {
     inputs_[0] = obj;
     inputs_[1] = key;
     inputs_[2] = val;
+    inputs_[3] = backing_store_owner;
   }
 
   bool is_fixed_typed_array() const {
@@ -2156,6 +2160,7 @@ class LStoreKeyed final : public LTemplateInstruction<0, 3, 0> {
   LOperand* elements() { return inputs_[0]; }
   LOperand* key() { return inputs_[1]; }
   LOperand* value() { return inputs_[2]; }
+  LOperand* backing_store_owner() { return inputs_[3]; }
   ElementsKind elements_kind() const {
     return hydrogen()->elements_kind();
   }