[turbofan] Fix lowering of typed loads/stores.

[turbofan] Fix lowering of typed loads/stores.

We can only access to external typed arrays; lowering of internal
typed arrays would require a map check plus eager deoptimization.
Also embed the array buffer reference directly instead of embedding
the typed array.

TEST=cctest,mjsunit,unittests
R=mstarzinger@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=24386

[Michael Starzinger, 2014-10-02 08:33:07]

LGTM.

https://codereview.chromium.org/621863002/diff/60001/src/factory.cc
File src/factory.cc (right):

https://codereview.chromium.org/621863002/diff/60001/src/factory.cc#newcode1773
src/factory.cc:1773: array->set_length(*NewNumberFromSize(length));
This is not handle-safe I think, GCMole will shout at you.

[Benedikt Meurer, 2014-10-02 08:38:55]

Committed patchset #5 (id:80001) manually as 24386 (presubmit successful).