[turbofan] Fix unsafe out-of-bounds check for checked loads/stores.

src/compiler/arm64/instruction-selector-arm64.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/instruction-selector-impl.h"
 #include "src/compiler/node-matchers.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
@@ skipping 372 matching lines @@
     case kRepFloat32:
       opcode = kCheckedLoadFloat32;
       break;
     case kRepFloat64:
       opcode = kCheckedLoadFloat64;
       break;
     default:
       UNREACHABLE();
       return;
   }
-  InstructionOperand* offset_operand = g.UseRegister(offset);
-  Emit(opcode | AddressingModeField::encode(kMode_MRR),
-       g.DefineAsRegister(node), offset_operand, g.UseRegister(length),
-       g.UseRegister(buffer), offset_operand);
+  Emit(opcode, g.DefineAsRegister(node), g.UseRegister(buffer),
+       g.UseRegister(offset), g.UseOperand(length, kArithmeticImm));
 }
 
 
 void InstructionSelector::VisitCheckedStore(Node* node) {
   MachineType rep = RepresentationOf(OpParameter<MachineType>(node));
   Arm64OperandGenerator g(this);
   Node* const buffer = node->InputAt(0);
   Node* const offset = node->InputAt(1);
   Node* const length = node->InputAt(2);
   Node* const value = node->InputAt(3);
@@ skipping 11 matching lines @@
     case kRepFloat32:
       opcode = kCheckedStoreFloat32;
       break;
     case kRepFloat64:
       opcode = kCheckedStoreFloat64;
       break;
     default:
       UNREACHABLE();
       return;
   }
-  InstructionOperand* offset_operand = g.UseRegister(offset);
-  Emit(opcode | AddressingModeField::encode(kMode_MRR), nullptr, offset_operand,
-       g.UseRegister(length), g.UseRegister(value), g.UseRegister(buffer),
-       offset_operand);
+  Emit(opcode, nullptr, g.UseRegister(buffer), g.UseRegister(offset),
+       g.UseOperand(length, kArithmeticImm), g.UseRegister(value));
 }
 
 
 template <typename Matcher>
 static void VisitLogical(InstructionSelector* selector, Node* node, Matcher* m,
                          ArchOpcode opcode, bool left_can_cover,
                          bool right_can_cover, ImmediateMode imm_mode) {
   Arm64OperandGenerator g(selector);
 
   // Map instruction to equivalent operation with inverted right input.
@@ skipping 1083 matching lines @@
          MachineOperatorBuilder::kFloat64Ceil |
          MachineOperatorBuilder::kFloat64RoundTruncate |
          MachineOperatorBuilder::kFloat64RoundTiesAway |
          MachineOperatorBuilder::kWord32ShiftIsSafe |
          MachineOperatorBuilder::kInt32DivIsSafe |
          MachineOperatorBuilder::kUint32DivIsSafe;
 }
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8