[turbofan] Lift incorrect restriction in serializer

Bug: v8:7790
Change-Id: Iab5df5e0f387612dfdb1f68b34941e65fe8e256c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561314Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60815}

src/compiler/serializer-for-background-compilation.cc

@@ -825,10 +825,8 @@ void SerializerForBackgroundCompilation::ProcessKeyedPropertyAccess(
     ObjectRef receiver_ref(broker(), hint);
 
     // For JSNativeContextSpecialization::ReduceElementAccess.
-    if (mode == AccessMode::kStore) {
-      if (receiver_ref.IsJSTypedArray()) {
-        receiver_ref.AsJSTypedArray().Serialize();
-      }
+    if (receiver_ref.IsJSTypedArray()) {
+      receiver_ref.AsJSTypedArray().Serialize();
     }
 
     // For JSNativeContextSpecialization::ReduceKeyedLoadFromHeapConstant.

test/mjsunit/compiler/typedarray-keyed.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Int8Array(100);
+
+function has(i) {
+  return i in a;
+}
+assertTrue(has(0));
+assertTrue(has(0));
+%OptimizeFunctionOnNextCall(has);
+assertTrue(has(0));
+assertTrue(has(1));
+
+function get(i) {
+  return a[i];
+}
+assertEquals(0, get(0));
+assertEquals(0, get(0));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(0, get(0));
+assertEquals(0, get(1));
+
+function set(i) {
+  const x = 42 + i;
+  return a[i] = x;
+}
+assertEquals(42, set(0)); assertEquals(42, a[0]);
+assertEquals(42, set(0)); assertEquals(42, a[0]);
+%OptimizeFunctionOnNextCall(set);
+assertEquals(42, set(0)); assertEquals(42, a[0]);
+assertEquals(43, set(1)); assertEquals(43, a[1]);