[csa] disable bounds checks for Set/Map accessors

This should recover the microbenchmark performance-regressions.

Bug: chromium:932919
Change-Id: I00e2345428c8730035dc1164278006d687364de7
Reviewed-on: https://chromium-review.googlesource.com/c/1477063Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59663}

src/code-stub-assembler.cc

@@ -3617,7 +3617,7 @@ void CodeStubAssembler::FindOrderedHashTableEntry(
     const std::function<void(Node*, Label*, Label*)>& key_compare,
     Variable* entry_start_position, Label* entry_found, Label* not_found) {
   // Get the index of the bucket.
-  Node* const number_of_buckets = SmiUntag(CAST(LoadFixedArrayElement(
+  Node* const number_of_buckets = SmiUntag(CAST(UnsafeLoadFixedArrayElement(
       CAST(table), CollectionType::NumberOfBucketsIndex())));
   Node* const bucket =
       WordAnd(hash, IntPtrSub(number_of_buckets, IntPtrConstant(1)));
@@ -3659,7 +3659,7 @@ void CodeStubAssembler::FindOrderedHashTableEntry(
                   number_of_buckets);
 
     // Load the key from the entry.
-    Node* const candidate_key = LoadFixedArrayElement(
+    Node* const candidate_key = UnsafeLoadFixedArrayElement(
         CAST(table), entry_start,
         CollectionType::HashTableStartIndex() * kTaggedSize);
 

src/code-stub-assembler.h

@@ -1016,6 +1016,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
       LoadSensitivity needs_poisoning = LoadSensitivity::kSafe,
       CheckBounds check_bounds = CheckBounds::kAlways);
 
+  // This doesn't emit a bounds-check. As part of the security-performance
+  // tradeoff, only use it if it is performance critical.
   TNode<Object> UnsafeLoadFixedArrayElement(
       TNode<FixedArray> object, Node* index, int additional_offset = 0,
       ParameterMode parameter_mode = INTPTR_PARAMETERS,
@@ -1046,6 +1048,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                  additional_offset, INTPTR_PARAMETERS,
                                  needs_poisoning);
   }
+  // This doesn't emit a bounds-check. As part of the security-performance
+  // tradeoff, only use it if it is performance critical.
   TNode<Object> UnsafeLoadFixedArrayElement(
       TNode<FixedArray> object, int index, int additional_offset = 0,
       LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
@@ -1256,6 +1260,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                   barrier_mode, 0, INTPTR_PARAMETERS,
                                   check_bounds);
   }
+  // This doesn't emit a bounds-check. As part of the security-performance
+  // tradeoff, only use it if it is performance critical.
   void UnsafeStoreFixedArrayElement(
       TNode<FixedArray> object, int index, SloppyTNode<Object> value,
       WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER) {
@@ -1269,6 +1275,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                   SKIP_WRITE_BARRIER, 0, INTPTR_PARAMETERS,
                                   check_bounds);
   }
+  // This doesn't emit a bounds-check. As part of the security-performance
+  // tradeoff, only use it if it is performance critical.
   void UnsafeStoreFixedArrayElement(TNode<FixedArray> object, int index,
                                     TNode<Smi> value) {
     return StoreFixedArrayElement(object, index, value,
@@ -1297,6 +1305,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                           additional_offset, parameter_mode);
   }
 
+  // This doesn't emit a bounds-check. As part of the security-performance
+  // tradeoff, only use it if it is performance critical.
   void UnsafeStoreFixedArrayElement(
       TNode<FixedArray> array, Node* index, SloppyTNode<Object> value,
       WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
@@ -1336,6 +1346,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
       TNode<FixedDoubleArray> object, Node* index, TNode<Float64T> value,
       ParameterMode parameter_mode = INTPTR_PARAMETERS,
       CheckBounds check_bounds = CheckBounds::kAlways);
+  // This doesn't emit a bounds-check. As part of the security-performance
+  // tradeoff, only use it if it is performance critical.
   void UnsafeStoreFixedDoubleArrayElement(
       TNode<FixedDoubleArray> object, Node* index, TNode<Float64T> value,
       ParameterMode parameter_mode = INTPTR_PARAMETERS) {