[crankshaft] Loads and stores to typed arrays have to reference the backing store holder

test/mjsunit/regress/typed-array-lifetime.js

Index: test/mjsunit/regress/typed-array-lifetime.js
diff --git a/test/mjsunit/regress/typed-array-lifetime.js b/test/mjsunit/regress/typed-array-lifetime.js
new file mode 100644
index 0000000000000000000000000000000000000000..db9a216531f03ee4128f14b0c9081af7e6fc529b
--- /dev/null
+++ b/test/mjsunit/regress/typed-array-lifetime.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --typed-array-max-size-in-heap=1
+
+var foo = (function () {
+  var y = 0;
+  return function foo(x) {
+    // Needs to be an external array.
+    var a = new Float64Array(32);
+    a[0] = 42;
+    y = x + 0.1;  // This has to allocate.
+    return a[0];
+  }
+})();
+
+foo(1);
+foo(1);
+%OptimizeFunctionOnNextCall(foo);
+foo(1);
+// Try to force a GC during allocation in above marked line.
+for (var i = 0; i < 20; ++i) {
+  %SetAllocationTimeout(i, i, false);
+  assertEquals(42, foo(2));
+}