[turbofan] Add checked load/store operators.

src/compiler/simplified-operator-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-graph.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/simplified-operator-reducer.h"
 
 namespace v8 {
@@ skipping 80 matching lines @@
                       m.node()->InputAt(0));
       }
       if (m.IsChangeUint32ToTagged()) return Replace(m.node()->InputAt(0));
       break;
     }
     case IrOpcode::kChangeUint32ToTagged: {
       Uint32Matcher m(node->InputAt(0));
       if (m.HasValue()) return ReplaceNumber(FastUI2D(m.Value()));
       break;
     }
-    case IrOpcode::kLoadElement: {
-      ElementAccess access = ElementAccessOf(node->op());
-      if (access.bounds_check == kTypedArrayBoundsCheck) {
-        NumberMatcher mkey(node->InputAt(1));
-        NumberMatcher mlength(node->InputAt(2));
-        if (mkey.HasValue() && mlength.HasValue()) {
-          // Skip the typed array bounds check if key and length are constant.
-          if (mkey.Value() >= 0 && mkey.Value() < mlength.Value()) {
-            access.bounds_check = kNoBoundsCheck;
-            node->set_op(simplified()->LoadElement(access));
-            return Changed(node);
-          }
-        }
-      }
-      break;
-    }
-    case IrOpcode::kStoreElement: {
-      ElementAccess access = ElementAccessOf(node->op());
-      if (access.bounds_check == kTypedArrayBoundsCheck) {
-        NumberMatcher mkey(node->InputAt(1));
-        NumberMatcher mlength(node->InputAt(2));
-        if (mkey.HasValue() && mlength.HasValue()) {
-          // Skip the typed array bounds check if key and length are constant.
-          if (mkey.Value() >= 0 && mkey.Value() < mlength.Value()) {
-            access.bounds_check = kNoBoundsCheck;
-            node->set_op(simplified()->StoreElement(access));
-            return Changed(node);
-          }
-        }
-      }
-      break;
-    }
     default:
       break;
   }
   return NoChange();
 }
 
 
 Reduction SimplifiedOperatorReducer::Change(Node* node, const Operator* op,
                                             Node* a) {
   node->set_op(op);
@@ skipping 30 matching lines @@
 }
 
 
 MachineOperatorBuilder* SimplifiedOperatorReducer::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8