[turbofan] Fix length accessor for RAB/GSAB in compiled code

Bug: v8:11111, chromium:1307340
Change-Id: I7c68d4985c080bf5c595a4ae3360fc924b1bdefb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3627595
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80452}

src/compiler/js-call-reducer.cc

@@ -7777,9 +7777,19 @@ Reduction JSCallReducer::ReduceArrayBufferViewAccessor(
   MapInference inference(broker(), receiver, effect);
   if (!inference.HaveMaps() ||
       !inference.AllOfInstanceTypesAre(instance_type)) {
-    return NoChange();
+    return inference.NoChange();
   }
 
+  // TODO(v8:11111): We skip this optimization for RAB/GSAB for now. Should
+  // have some optimization here eventually.
+  for (const auto& map : inference.GetMaps()) {
+    if (IsRabGsabTypedArrayElementsKind(map.elements_kind())) {
+      return inference.NoChange();
+    }
+  }
+
+  CHECK(inference.RelyOnMapsViaStability(dependencies()));
+
   // Load the {receiver}s field.
   Node* value = effect = graph()->NewNode(simplified()->LoadField(access),
                                           receiver, effect, control);

test/mjsunit/compiler/typedarray-resizablearraybuffer.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-rab-gsab --allow-natives-syntax --turbofan
+
+"use strict";
+
+d8.file.execute('test/mjsunit/typedarray-helpers.js');
+
+(function TypedArrayLength() {
+  for(let ctor of ctors) {
+    // We have to make sure that we construct a new string for each case to
+    // prevent the compiled function from being reused with spoiled feedback.
+    const test = new Function('\
+      const rab = CreateResizableArrayBuffer(16, 40); \
+      const ta = new ' + ctor.name + '(rab); \
+      rab.resize(32); \
+      return ta.length;');
+
+    %PrepareFunctionForOptimization(test);
+    assertEquals(32 / ctor.BYTES_PER_ELEMENT, test(ctor));
+    assertEquals(32 / ctor.BYTES_PER_ELEMENT, test(ctor));
+    %OptimizeFunctionOnNextCall(test);
+    assertEquals(32 / ctor.BYTES_PER_ELEMENT, test(ctor));
+  }
+})();