[turbofan] Deoptimize on access to neutered typed arrays.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 246 matching lines @@
               graph()->NewNode(simplified()->LoadField(
                                    AccessBuilder::ForJSArrayBufferBitField()),
                                this_buffer, this_effect, this_control);
           Node* check = graph()->NewNode(
               machine()->Word32Equal(),
               graph()->NewNode(machine()->Word32And(), this_buffer_bit_field,
                                jsgraph()->Int32Constant(
                                    1 << JSArrayBuffer::WasNeutered::kShift)),
               jsgraph()->Int32Constant(0));
           this_control =
-              graph()->NewNode(common()->DeoptimizeIf(), check, frame_state,
+              graph()->NewNode(common()->DeoptimizeUnless(), check, frame_state,
                                this_effect, this_control);
           break;
         }
       }
       if (access_mode == AccessMode::kLoad &&
           access_info.holder().ToHandle(&holder)) {
         this_receiver = jsgraph()->Constant(holder);
       }
       Node* this_storage = this_receiver;
       if (!field_index.is_inobject()) {
@@ skipping 885 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8