[turbofan] Don't constant-fold typed-array with on-heap buffer.

When generating code for element accesses, we used to constant-fold
JSTypedArray receivers even when their buffers were on the JS heap.
This required a call to MaterializeArrayBuffer, which hinders
background compilation. Since the benefit of this optimization is
believed to be small, we decided to remove it.

Bug: v8:7790
Change-Id: I28d3a57b3d8f5b58b6e00e0bb8328b682a6fbd88
Reviewed-on: https://chromium-review.googlesource.com/c/1256831
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56434}

src/compiler/js-native-context-specialization.cc

@@ -2332,6 +2332,15 @@ ExternalArrayType GetArrayTypeFromElementsKind(ElementsKind kind) {
   UNREACHABLE();
 }
 
+MaybeHandle<JSTypedArray> GetTypedArrayConstant(Node* receiver) {
+  HeapObjectMatcher m(receiver);
+  if (!m.HasValue()) return MaybeHandle<JSTypedArray>();
+  if (!m.Value()->IsJSTypedArray()) return MaybeHandle<JSTypedArray>();
+  Handle<JSTypedArray> typed_array = Handle<JSTypedArray>::cast(m.Value());
+  if (typed_array->is_on_heap()) return MaybeHandle<JSTypedArray>();
+  return typed_array;
+}
+
 }  // namespace
 
 JSNativeContextSpecialization::ValueEffectControl
@@ -2353,16 +2362,12 @@ JSNativeContextSpecialization::BuildElementAccess(
 
     // Check if we can constant-fold information about the {receiver} (i.e.
     // for asm.js-like code patterns).
-    HeapObjectMatcher m(receiver);
-    if (m.HasValue() && m.Value()->IsJSTypedArray()) {
-      Handle<JSTypedArray> typed_array = Handle<JSTypedArray>::cast(m.Value());
-
-      // Determine the {receiver}s (known) length.
+    Handle<JSTypedArray> typed_array;
+    if (GetTypedArrayConstant(receiver).ToHandle(&typed_array)) {
+      buffer = jsgraph()->HeapConstant(typed_array->GetBuffer());
       length =
           jsgraph()->Constant(static_cast<double>(typed_array->length_value()));
 
-      buffer = jsgraph()->HeapConstant(typed_array->GetBuffer());
-
       // Load the (known) base and external pointer for the {receiver}. The
       // {external_pointer} might be invalid if the {buffer} was neutered, so
       // we need to make sure that any access is properly guarded.