[turbofan] Introduce new Select operator to improve bounds checking.

test/unittests/compiler/js-typed-lowering-unittest.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-properties-inl.h"
@@ skipping 96 matching lines @@
             IsBooleanNot(IsNumberEqual(p0, IsNumberConstant(0))), p1, control));
 }
 
 
 // -----------------------------------------------------------------------------
 // JSLoadProperty
 
 
 TEST_F(JSTypedLoweringTest, JSLoadPropertyFromExternalTypedArray) {
   const size_t kLength = 17;
-  uint8_t backing_store[kLength * 8];
+  double backing_store[kLength];
   Handle<JSArrayBuffer> buffer =
-      NewArrayBuffer(backing_store, arraysize(backing_store));
+      NewArrayBuffer(backing_store, sizeof(backing_store));
   VectorSlotPair feedback(Handle<TypeFeedbackVector>::null(),
                           FeedbackVectorICSlot::Invalid());
   TRACED_FOREACH(ExternalArrayType, type, kExternalArrayTypes) {
     Handle<JSTypedArray> array =
         factory()->NewJSTypedArray(type, buffer, 0, kLength);
 
     Node* key = Parameter(Type::Integral32());
     Node* base = HeapConstant(array);
     Node* context = UndefinedConstant();
     Node* effect = graph()->start();
     Node* control = graph()->start();
     Node* node = graph()->NewNode(javascript()->LoadProperty(feedback), base,
                                   key, context);
     if (FLAG_turbo_deoptimization) {
       node->AppendInput(zone(), UndefinedConstant());
     }
     node->AppendInput(zone(), effect);
     node->AppendInput(zone(), control);
     Reduction r = Reduce(node);
 
     ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(
-        r.replacement(),
-        IsLoadElement(AccessBuilder::ForTypedArrayElement(type, true),
-                      IsIntPtrConstant(bit_cast<intptr_t>(&backing_store[0])),
-                      key, IsNumberConstant(static_cast<double>(kLength)),
-                      effect));
+    EXPECT_THAT(r.replacement(),
+                IsLoadElement(
+                    AccessBuilder::ForTypedArrayElement(type, true),
+                    IsIntPtrConstant(bit_cast<intptr_t>(&backing_store[0])),
+                    key, IsNumberConstant(array->length()->Number()), effect));
   }
 }
 
 
 // -----------------------------------------------------------------------------
 // JSStoreProperty
 
 
 TEST_F(JSTypedLoweringTest, JSStorePropertyToExternalTypedArray) {
   const size_t kLength = 17;
-  uint8_t backing_store[kLength * 8];
+  double backing_store[kLength];
   Handle<JSArrayBuffer> buffer =
-      NewArrayBuffer(backing_store, arraysize(backing_store));
+      NewArrayBuffer(backing_store, sizeof(backing_store));
   TRACED_FOREACH(ExternalArrayType, type, kExternalArrayTypes) {
     TRACED_FOREACH(StrictMode, strict_mode, kStrictModes) {
       Handle<JSTypedArray> array =
           factory()->NewJSTypedArray(type, buffer, 0, kLength);
 
       Node* key = Parameter(Type::Integral32());
       Node* base = HeapConstant(array);
       Node* value = Parameter(Type::Any());
       Node* context = UndefinedConstant();
       Node* effect = graph()->start();
       Node* control = graph()->start();
       Node* node = graph()->NewNode(javascript()->StoreProperty(strict_mode),
                                     base, key, value, context);
       if (FLAG_turbo_deoptimization) {
         node->AppendInput(zone(), UndefinedConstant());
       }
       node->AppendInput(zone(), effect);
       node->AppendInput(zone(), control);
       Reduction r = Reduce(node);
 
       ASSERT_TRUE(r.Changed());
       EXPECT_THAT(r.replacement(),
                   IsStoreElement(
                       AccessBuilder::ForTypedArrayElement(type, true),
                       IsIntPtrConstant(bit_cast<intptr_t>(&backing_store[0])),
-                      key, IsNumberConstant(static_cast<double>(kLength)),
-                      value, effect, control));
+                      key, IsNumberConstant(array->length()->Number()), value,
+                      effect, control));
     }
   }
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8