[Backport] [turbofan] Remove obsolete LoadBuffer and StoreBuffer operators.

These operators were only used by the old asm.js pipeline (with
fullcodegen and the AstGraphBuilder). When going through the new
pipeline, accesses to TypedArrays are handled by the native
context specialization during inlining.

Bug: v8:6409
Reviewed-on: https://chromium-review.googlesource.com/612347

Change-Id: Ia7a8d9d6564e38356c1cb0564490703e045480d8
Reviewed-by: Alexandru Croitor <alexandru.croitor@qt.io>

10 files changed, 1 insertions, 419 deletions

diff --git a/chromium/v8/src/compiler/js-typed-lowering.cc b/chromium/v8/src/compiler/js-typed-lowering.cc
index 243a80a645c..567a332137f 100644
--- a/chromium/v8/src/compiler/js-typed-lowering.cc
+++ b/chromium/v8/src/compiler/js-typed-lowering.cc
@@ -529,13 +529,7 @@ JSTypedLowering::JSTypedLowering(Editor* editor,
                       Type::Union(Type::SymbolOrReceiver(), Type::EmptyString(),
                                   graph()->zone()),
                       graph()->zone())),
-      type_cache_(TypeCache::Get()) {
-  for (size_t k = 0; k < arraysize(shifted_int32_ranges_); ++k) {
-    double min = kMinInt / (1 << k);
-    double max = kMaxInt / (1 << k);
-    shifted_int32_ranges_[k] = Type::Range(min, max, graph()->zone());
-  }
-}
+      type_cache_(TypeCache::Get()) {}
 
 Reduction JSTypedLowering::ReduceSpeculativeNumberAdd(Node* node) {
   JSBinopReduction r(this, node);
@@ -1397,131 +1391,6 @@ Reduction JSTypedLowering::ReduceJSLoadNamed(Node* node) {
   return NoChange();
 }
 
-Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) {
-  Node* key = NodeProperties::GetValueInput(node, 1);
-  Node* base = NodeProperties::GetValueInput(node, 0);
-  Type* key_type = NodeProperties::GetType(key);
-  HeapObjectMatcher mbase(base);
-  if (mbase.HasValue() && mbase.Value()->IsJSTypedArray()) {
-    Handle<JSTypedArray> const array =
-        Handle<JSTypedArray>::cast(mbase.Value());
-    if (!array->GetBuffer()->was_neutered() &&
-        !array->GetBuffer()->is_wasm_buffer()) {
-      array->GetBuffer()->set_is_neuterable(false);
-      BufferAccess const access(array->type());
-      size_t const k =
-          ElementSizeLog2Of(access.machine_type().representation());
-      double const byte_length = array->byte_length()->Number();
-      CHECK_LT(k, arraysize(shifted_int32_ranges_));
-      if (key_type->Is(shifted_int32_ranges_[k]) && byte_length <= kMaxInt) {
-        // JSLoadProperty(typed-array, int32)
-        Handle<FixedTypedArrayBase> elements =
-            Handle<FixedTypedArrayBase>::cast(handle(array->elements()));
-        Node* buffer = jsgraph()->PointerConstant(elements->external_pointer());
-        Node* length = jsgraph()->Constant(byte_length);
-        Node* effect = NodeProperties::GetEffectInput(node);
-        Node* control = NodeProperties::GetControlInput(node);
-        // Check if we can avoid the bounds check.
-        if (key_type->Min() >= 0 && key_type->Max() < array->length_value()) {
-          Node* load = graph()->NewNode(
-              simplified()->LoadElement(
-                  AccessBuilder::ForTypedArrayElement(array->type(), true)),
-              buffer, key, effect, control);
-          ReplaceWithValue(node, load, load);
-          return Replace(load);
-        }
-        // Compute byte offset.
-        Node* offset =
-            (k == 0) ? key : graph()->NewNode(
-                                 simplified()->NumberShiftLeft(), key,
-                                 jsgraph()->Constant(static_cast<double>(k)));
-        Node* load = graph()->NewNode(simplified()->LoadBuffer(access), buffer,
-                                      offset, length, effect, control);
-        ReplaceWithValue(node, load, load);
-        return Replace(load);
-      }
-    }
-  }
-  return NoChange();
-}
-
-Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) {
-  Node* key = NodeProperties::GetValueInput(node, 1);
-  Node* base = NodeProperties::GetValueInput(node, 0);
-  Node* value = NodeProperties::GetValueInput(node, 2);
-  Type* key_type = NodeProperties::GetType(key);
-  Type* value_type = NodeProperties::GetType(value);
-
-  if (!value_type->Is(Type::PlainPrimitive())) return NoChange();
-
-  HeapObjectMatcher mbase(base);
-  if (mbase.HasValue() && mbase.Value()->IsJSTypedArray()) {
-    Handle<JSTypedArray> const array =
-        Handle<JSTypedArray>::cast(mbase.Value());
-    if (!array->GetBuffer()->was_neutered() &&
-        !array->GetBuffer()->is_wasm_buffer()) {
-      array->GetBuffer()->set_is_neuterable(false);
-      BufferAccess const access(array->type());
-      size_t const k =
-          ElementSizeLog2Of(access.machine_type().representation());
-      double const byte_length = array->byte_length()->Number();
-      CHECK_LT(k, arraysize(shifted_int32_ranges_));
-      if (access.external_array_type() != kExternalUint8ClampedArray &&
-          key_type->Is(shifted_int32_ranges_[k]) && byte_length <= kMaxInt) {
-        // JSLoadProperty(typed-array, int32)
-        Handle<FixedTypedArrayBase> elements =
-            Handle<FixedTypedArrayBase>::cast(handle(array->elements()));
-        Node* buffer = jsgraph()->PointerConstant(elements->external_pointer());
-        Node* length = jsgraph()->Constant(byte_length);
-        Node* effect = NodeProperties::GetEffectInput(node);
-        Node* control = NodeProperties::GetControlInput(node);
-        // Convert to a number first.
-        if (!value_type->Is(Type::Number())) {
-          Reduction number_reduction = ReduceJSToNumberInput(value);
-          if (number_reduction.Changed()) {
-            value = number_reduction.replacement();
-          } else {
-            value =
-                graph()->NewNode(simplified()->PlainPrimitiveToNumber(), value);
-          }
-        }
-        // Check if we can avoid the bounds check.
-        if (key_type->Min() >= 0 && key_type->Max() < array->length_value()) {
-          RelaxControls(node);
-          node->ReplaceInput(0, buffer);
-          DCHECK_EQ(key, node->InputAt(1));
-          node->ReplaceInput(2, value);
-          node->ReplaceInput(3, effect);
-          node->ReplaceInput(4, control);
-          node->TrimInputCount(5);
-          NodeProperties::ChangeOp(
-              node,
-              simplified()->StoreElement(
-                  AccessBuilder::ForTypedArrayElement(array->type(), true)));
-          return Changed(node);
-        }
-        // Compute byte offset.
-        Node* offset =
-            (k == 0) ? key : graph()->NewNode(
-                                 simplified()->NumberShiftLeft(), key,
-                                 jsgraph()->Constant(static_cast<double>(k)));
-        // Turn into a StoreBuffer operation.
-        RelaxControls(node);
-        node->ReplaceInput(0, buffer);
-        node->ReplaceInput(1, offset);
-        node->ReplaceInput(2, length);
-        node->ReplaceInput(3, value);
-        node->ReplaceInput(4, effect);
-        node->ReplaceInput(5, control);
-        node->TrimInputCount(6);
-        NodeProperties::ChangeOp(node, simplified()->StoreBuffer(access));
-        return Changed(node);
-      }
-    }
-  }
-  return NoChange();
-}
-
 Reduction JSTypedLowering::ReduceJSHasInPrototypeChain(Node* node) {
   DCHECK_EQ(IrOpcode::kJSHasInPrototypeChain, node->opcode());
   Node* value = NodeProperties::GetValueInput(node, 0);
@@ -2530,10 +2399,6 @@ Reduction JSTypedLowering::Reduce(Node* node) {
       return ReduceJSTypeOf(node);
     case IrOpcode::kJSLoadNamed:
       return ReduceJSLoadNamed(node);
-    case IrOpcode::kJSLoadProperty:
-      return ReduceJSLoadProperty(node);
-    case IrOpcode::kJSStoreProperty:
-      return ReduceJSStoreProperty(node);
     case IrOpcode::kJSLoadContext:
       return ReduceJSLoadContext(node);
     case IrOpcode::kJSStoreContext:
diff --git a/chromium/v8/src/compiler/js-typed-lowering.h b/chromium/v8/src/compiler/js-typed-lowering.h
index b2e2a162ed3..d2cbca8e3fa 100644
--- a/chromium/v8/src/compiler/js-typed-lowering.h
+++ b/chromium/v8/src/compiler/js-typed-lowering.h
@@ -52,8 +52,6 @@ class V8_EXPORT_PRIVATE JSTypedLowering final
   Reduction ReduceJSAdd(Node* node);
   Reduction ReduceJSComparison(Node* node);
   Reduction ReduceJSLoadNamed(Node* node);
-  Reduction ReduceJSLoadProperty(Node* node);
-  Reduction ReduceJSStoreProperty(Node* node);
   Reduction ReduceJSHasInPrototypeChain(Node* node);
   Reduction ReduceJSOrdinaryHasInstance(Node* node);
   Reduction ReduceJSLoadContext(Node* node);
@@ -117,7 +115,6 @@ class V8_EXPORT_PRIVATE JSTypedLowering final
   CompilationDependencies* dependencies_;
   Flags flags_;
   JSGraph* jsgraph_;
-  Type* shifted_int32_ranges_[4];
   Type* pointer_comparable_type_;
   TypeCache const& type_cache_;
 };
diff --git a/chromium/v8/src/compiler/load-elimination.cc b/chromium/v8/src/compiler/load-elimination.cc
index 775da82587b..b60e974396f 100644
--- a/chromium/v8/src/compiler/load-elimination.cc
+++ b/chromium/v8/src/compiler/load-elimination.cc
@@ -1167,7 +1167,6 @@ LoadElimination::AbstractState const* LoadElimination::ComputeLoopState(
             state = state->KillElement(object, index, zone());
             break;
           }
-          case IrOpcode::kStoreBuffer:
           case IrOpcode::kStoreTypedElement: {
             // Doesn't affect anything we track with the state currently.
             break;
diff --git a/chromium/v8/src/compiler/opcodes.h b/chromium/v8/src/compiler/opcodes.h
index c829a39e37e..15b6b5905d2 100644
--- a/chromium/v8/src/compiler/opcodes.h
+++ b/chromium/v8/src/compiler/opcodes.h
@@ -339,11 +339,9 @@
   V(ConvertTaggedHoleToUndefined)   \
   V(Allocate)                       \
   V(LoadField)                      \
-  V(LoadBuffer)                     \
   V(LoadElement)                    \
   V(LoadTypedElement)               \
   V(StoreField)                     \
-  V(StoreBuffer)                    \
   V(StoreElement)                   \
   V(StoreTypedElement)              \
   V(TransitionAndStoreElement)      \
diff --git a/chromium/v8/src/compiler/simplified-lowering.cc b/chromium/v8/src/compiler/simplified-lowering.cc
index 19578fc7acd..c1d32b2d55c 100644
--- a/chromium/v8/src/compiler/simplified-lowering.cc
+++ b/chromium/v8/src/compiler/simplified-lowering.cc
@@ -2504,53 +2504,6 @@ class RepresentationSelector {
         }
         return;
       }
-      case IrOpcode::kLoadBuffer: {
-        if (truncation.IsUnused()) return VisitUnused(node);
-        BufferAccess access = BufferAccessOf(node->op());
-        ProcessInput(node, 0, UseInfo::PointerInt());        // buffer
-        ProcessInput(node, 1, UseInfo::TruncatingWord32());  // offset
-        ProcessInput(node, 2, UseInfo::TruncatingWord32());  // length
-        ProcessRemainingInputs(node, 3);
-
-        MachineRepresentation output;
-        if (truncation.IdentifiesUndefinedAndNaNAndZero()) {
-          if (truncation.IdentifiesNaNAndZero()) {
-            // If undefined is truncated to a non-NaN number, we can use
-            // the load's representation.
-            output = access.machine_type().representation();
-          } else {
-            // If undefined is truncated to a number, but the use can
-            // observe NaN, we need to output at least the float32
-            // representation.
-            if (access.machine_type().representation() ==
-                MachineRepresentation::kFloat32) {
-              output = access.machine_type().representation();
-            } else {
-              output = MachineRepresentation::kFloat64;
-            }
-          }
-        } else {
-          // If undefined is not truncated away, we need to have the tagged
-          // representation.
-          output = MachineRepresentation::kTagged;
-        }
-        SetOutput(node, output);
-        if (lower()) lowering->DoLoadBuffer(node, output, changer_);
-        return;
-      }
-      case IrOpcode::kStoreBuffer: {
-        BufferAccess access = BufferAccessOf(node->op());
-        ProcessInput(node, 0, UseInfo::PointerInt());        // buffer
-        ProcessInput(node, 1, UseInfo::TruncatingWord32());  // offset
-        ProcessInput(node, 2, UseInfo::TruncatingWord32());  // length
-        ProcessInput(node, 3,
-                     TruncatingUseInfoFromRepresentation(
-                         access.machine_type().representation()));  // value
-        ProcessRemainingInputs(node, 4);
-        SetOutput(node, MachineRepresentation::kNone);
-        if (lower()) lowering->DoStoreBuffer(node);
-        return;
-      }
       case IrOpcode::kLoadElement: {
         if (truncation.IsUnused()) return VisitUnused(node);
         ElementAccess access = ElementAccessOf(node->op());
@@ -3226,76 +3179,6 @@ void SimplifiedLowering::DoJSToNumberTruncatesToWord32(
   selector->DeferReplacement(node, value);
 }
 
-void SimplifiedLowering::DoLoadBuffer(Node* node,
-                                      MachineRepresentation output_rep,
-                                      RepresentationChanger* changer) {
-  DCHECK_EQ(IrOpcode::kLoadBuffer, node->opcode());
-  DCHECK_NE(MachineRepresentation::kNone, output_rep);
-  MachineType const access_type = BufferAccessOf(node->op()).machine_type();
-  if (output_rep != access_type.representation()) {
-    Node* const buffer = node->InputAt(0);
-    Node* const offset = node->InputAt(1);
-    Node* const length = node->InputAt(2);
-    Node* const effect = node->InputAt(3);
-    Node* const control = node->InputAt(4);
-    Node* const index =
-        machine()->Is64()
-            ? graph()->NewNode(machine()->ChangeUint32ToUint64(), offset)
-            : offset;
-
-    Node* check = graph()->NewNode(machine()->Uint32LessThan(), offset, length);
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
-
-    Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-    Node* etrue = graph()->NewNode(machine()->Load(access_type), buffer, index,
-                                   effect, if_true);
-    Type* element_type =
-        Type::Intersect(NodeProperties::GetType(node), Type::Number(), zone());
-    Node* vtrue = changer->GetRepresentationFor(
-        etrue, access_type.representation(), element_type, node,
-        UseInfo(output_rep, Truncation::None()));
-
-    Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-    Node* efalse = effect;
-    Node* vfalse;
-    if (output_rep == MachineRepresentation::kTagged) {
-      vfalse = jsgraph()->UndefinedConstant();
-    } else if (output_rep == MachineRepresentation::kFloat64) {
-      vfalse =
-          jsgraph()->Float64Constant(std::numeric_limits<double>::quiet_NaN());
-    } else if (output_rep == MachineRepresentation::kFloat32) {
-      vfalse =
-          jsgraph()->Float32Constant(std::numeric_limits<float>::quiet_NaN());
-    } else {
-      vfalse = jsgraph()->Int32Constant(0);
-    }
-
-    Node* merge = graph()->NewNode(common()->Merge(2), if_true, if_false);
-    Node* ephi = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, merge);
-
-    // Replace effect uses of {node} with the {ephi}.
-    NodeProperties::ReplaceUses(node, node, ephi);
-
-    // Turn the {node} into a Phi.
-    node->ReplaceInput(0, vtrue);
-    node->ReplaceInput(1, vfalse);
-    node->ReplaceInput(2, merge);
-    node->TrimInputCount(3);
-    NodeProperties::ChangeOp(node, common()->Phi(output_rep, 2));
-  } else {
-    NodeProperties::ChangeOp(node, machine()->CheckedLoad(access_type));
-  }
-}
-
-
-void SimplifiedLowering::DoStoreBuffer(Node* node) {
-  DCHECK_EQ(IrOpcode::kStoreBuffer, node->opcode());
-  MachineRepresentation const rep =
-      BufferAccessOf(node->op()).machine_type().representation();
-  NodeProperties::ChangeOp(node, machine()->CheckedStore(rep));
-}
-
 Node* SimplifiedLowering::Float64Round(Node* const node) {
   Node* const one = jsgraph()->Float64Constant(1.0);
   Node* const one_half = jsgraph()->Float64Constant(0.5);
diff --git a/chromium/v8/src/compiler/simplified-lowering.h b/chromium/v8/src/compiler/simplified-lowering.h
index 09e58ff18a1..22fb77f8fa6 100644
--- a/chromium/v8/src/compiler/simplified-lowering.h
+++ b/chromium/v8/src/compiler/simplified-lowering.h
@@ -34,11 +34,6 @@ class SimplifiedLowering final {
                                       RepresentationSelector* selector);
   void DoJSToNumberTruncatesToWord32(Node* node,
                                      RepresentationSelector* selector);
-  // TODO(turbofan): The representation can be removed once the result of the
-  // representation analysis is stored in the node bounds.
-  void DoLoadBuffer(Node* node, MachineRepresentation rep,
-                    RepresentationChanger* changer);
-  void DoStoreBuffer(Node* node);
   void DoShift(Node* node, Operator const* op, Type* rhs_type);
   void DoStringToNumber(Node* node);
   void DoIntegral32ToBit(Node* node);
diff --git a/chromium/v8/src/compiler/simplified-operator.cc b/chromium/v8/src/compiler/simplified-operator.cc
index 29e466925f2..608981ac943 100644
--- a/chromium/v8/src/compiler/simplified-operator.cc
+++ b/chromium/v8/src/compiler/simplified-operator.cc
@@ -29,63 +29,6 @@ std::ostream& operator<<(std::ostream& os, BaseTaggedness base_taggedness) {
   UNREACHABLE();
 }
 
-
-MachineType BufferAccess::machine_type() const {
-  switch (external_array_type_) {
-    case kExternalUint8Array:
-    case kExternalUint8ClampedArray:
-      return MachineType::Uint8();
-    case kExternalInt8Array:
-      return MachineType::Int8();
-    case kExternalUint16Array:
-      return MachineType::Uint16();
-    case kExternalInt16Array:
-      return MachineType::Int16();
-    case kExternalUint32Array:
-      return MachineType::Uint32();
-    case kExternalInt32Array:
-      return MachineType::Int32();
-    case kExternalFloat32Array:
-      return MachineType::Float32();
-    case kExternalFloat64Array:
-      return MachineType::Float64();
-  }
-  UNREACHABLE();
-}
-
-
-bool operator==(BufferAccess lhs, BufferAccess rhs) {
-  return lhs.external_array_type() == rhs.external_array_type();
-}
-
-
-bool operator!=(BufferAccess lhs, BufferAccess rhs) { return !(lhs == rhs); }
-
-
-size_t hash_value(BufferAccess access) {
-  return base::hash<ExternalArrayType>()(access.external_array_type());
-}
-
-
-std::ostream& operator<<(std::ostream& os, BufferAccess access) {
-  switch (access.external_array_type()) {
-#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
-  case kExternal##Type##Array:                          \
-    return os << #Type;
-    TYPED_ARRAYS(TYPED_ARRAY_CASE)
-#undef TYPED_ARRAY_CASE
-  }
-  UNREACHABLE();
-}
-
-
-BufferAccess const BufferAccessOf(const Operator* op) {
-  DCHECK(op->opcode() == IrOpcode::kLoadBuffer ||
-         op->opcode() == IrOpcode::kStoreBuffer);
-  return OpParameter<BufferAccess>(op);
-}
-
-
 bool operator==(FieldAccess const& lhs, FieldAccess const& rhs) {
   // On purpose we don't include the write barrier kind here, as this method is
   // really only relevant for eliminating loads and they don't care about the
@@ -806,28 +749,6 @@ struct SimplifiedOperatorGlobalCache final {
       kSpeculativeToNumberNumberOperator;
   SpeculativeToNumberOperator<NumberOperationHint::kNumberOrOddball>
       kSpeculativeToNumberNumberOrOddballOperator;
-
-#define BUFFER_ACCESS(Type, type, TYPE, ctype, size)                          \
-  struct LoadBuffer##Type##Operator final : public Operator1<BufferAccess> {  \
-    LoadBuffer##Type##Operator()                                              \
-        : Operator1<BufferAccess>(                                            \
-              IrOpcode::kLoadBuffer,                                          \
-              Operator::kNoDeopt | Operator::kNoThrow | Operator::kNoWrite,   \
-              "LoadBuffer", 3, 1, 1, 1, 1, 0,                                 \
-              BufferAccess(kExternal##Type##Array)) {}                        \
-  };                                                                          \
-  struct StoreBuffer##Type##Operator final : public Operator1<BufferAccess> { \
-    StoreBuffer##Type##Operator()                                             \
-        : Operator1<BufferAccess>(                                            \
-              IrOpcode::kStoreBuffer,                                         \
-              Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow,    \
-              "StoreBuffer", 4, 1, 1, 0, 1, 0,                                \
-              BufferAccess(kExternal##Type##Array)) {}                        \
-  };                                                                          \
-  LoadBuffer##Type##Operator kLoadBuffer##Type;                               \
-  StoreBuffer##Type##Operator kStoreBuffer##Type;
-  TYPED_ARRAYS(BUFFER_ACCESS)
-#undef BUFFER_ACCESS
 };
 
 
@@ -1029,30 +950,6 @@ const Operator* SimplifiedOperatorBuilder::Allocate(Type* type,
       1, 1, 1, 1, 1, 0, AllocateParameters(type, pretenure));
 }
 
-
-const Operator* SimplifiedOperatorBuilder::LoadBuffer(BufferAccess access) {
-  switch (access.external_array_type()) {
-#define LOAD_BUFFER(Type, type, TYPE, ctype, size) \
-  case kExternal##Type##Array:                     \
-    return &cache_.kLoadBuffer##Type;
-    TYPED_ARRAYS(LOAD_BUFFER)
-#undef LOAD_BUFFER
-  }
-  UNREACHABLE();
-}
-
-
-const Operator* SimplifiedOperatorBuilder::StoreBuffer(BufferAccess access) {
-  switch (access.external_array_type()) {
-#define STORE_BUFFER(Type, type, TYPE, ctype, size) \
-  case kExternal##Type##Array:                      \
-    return &cache_.kStoreBuffer##Type;
-    TYPED_ARRAYS(STORE_BUFFER)
-#undef STORE_BUFFER
-  }
-  UNREACHABLE();
-}
-
 const Operator* SimplifiedOperatorBuilder::StringFromCodePoint(
     UnicodeEncoding encoding) {
   switch (encoding) {
diff --git a/chromium/v8/src/compiler/simplified-operator.h b/chromium/v8/src/compiler/simplified-operator.h
index f2739acef39..2008690cf9e 100644
--- a/chromium/v8/src/compiler/simplified-operator.h
+++ b/chromium/v8/src/compiler/simplified-operator.h
@@ -34,30 +34,6 @@ size_t hash_value(BaseTaggedness);
 
 std::ostream& operator<<(std::ostream&, BaseTaggedness);
 
-
-// An access descriptor for loads/stores of array buffers.
-class BufferAccess final {
- public:
-  explicit BufferAccess(ExternalArrayType external_array_type)
-      : external_array_type_(external_array_type) {}
-
-  ExternalArrayType external_array_type() const { return external_array_type_; }
-  MachineType machine_type() const;
-
- private:
-  ExternalArrayType const external_array_type_;
-};
-
-V8_EXPORT_PRIVATE bool operator==(BufferAccess, BufferAccess);
-bool operator!=(BufferAccess, BufferAccess);
-
-size_t hash_value(BufferAccess);
-
-V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, BufferAccess);
-
-V8_EXPORT_PRIVATE BufferAccess const BufferAccessOf(const Operator* op)
-    WARN_UNUSED_RESULT;
-
 // An access descriptor for loads/stores of fixed structures like field
 // accesses of heap objects. Accesses from either tagged or untagged base
 // pointers are supported; untagging is done automatically during lowering.
@@ -485,12 +461,6 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* LoadField(FieldAccess const&);
   const Operator* StoreField(FieldAccess const&);
 
-  // load-buffer buffer, offset, length
-  const Operator* LoadBuffer(BufferAccess);
-
-  // store-buffer buffer, offset, length, value
-  const Operator* StoreBuffer(BufferAccess);
-
   // load-element [base + index]
   const Operator* LoadElement(ElementAccess const&);
 
diff --git a/chromium/v8/src/compiler/typer.cc b/chromium/v8/src/compiler/typer.cc
index 64a028015c2..fdbacd34aa1 100644
--- a/chromium/v8/src/compiler/typer.cc
+++ b/chromium/v8/src/compiler/typer.cc
@@ -1921,18 +1921,6 @@ Type* Typer::Visitor::TypeLoadField(Node* node) {
   return FieldAccessOf(node->op()).type;
 }
 
-Type* Typer::Visitor::TypeLoadBuffer(Node* node) {
-  switch (BufferAccessOf(node->op()).external_array_type()) {
-#define TYPED_ARRAY_CASE(ElemType, type, TYPE, ctype, size) \
-  case kExternal##ElemType##Array:                          \
-    return Type::Union(typer_->cache_.k##ElemType, Type::Undefined(), zone());
-    TYPED_ARRAYS(TYPED_ARRAY_CASE)
-#undef TYPED_ARRAY_CASE
-  }
-  UNREACHABLE();
-}
-
-
 Type* Typer::Visitor::TypeLoadElement(Node* node) {
   return ElementAccessOf(node->op()).type;
 }
@@ -1952,12 +1940,6 @@ Type* Typer::Visitor::TypeStoreField(Node* node) {
   UNREACHABLE();
 }
 
-
-Type* Typer::Visitor::TypeStoreBuffer(Node* node) {
-  UNREACHABLE();
-}
-
-
 Type* Typer::Visitor::TypeStoreElement(Node* node) {
   UNREACHABLE();
 }
diff --git a/chromium/v8/src/compiler/verifier.cc b/chromium/v8/src/compiler/verifier.cc
index dbb05460a28..875cbe3cb92 100644
--- a/chromium/v8/src/compiler/verifier.cc
+++ b/chromium/v8/src/compiler/verifier.cc
@@ -1260,8 +1260,6 @@ void Verifier::Visitor::Check(Node* node) {
       // CheckValueInputIs(node, 0, Type::Object());
       // CheckTypeIs(node, FieldAccessOf(node->op()).type));
       break;
-    case IrOpcode::kLoadBuffer:
-      break;
     case IrOpcode::kLoadElement:
       // Object -> elementtype
       // TODO(rossberg): activate once machine ops are typed.
@@ -1277,8 +1275,6 @@ void Verifier::Visitor::Check(Node* node) {
       // CheckValueInputIs(node, 1, FieldAccessOf(node->op()).type));
       CheckNotTyped(node);
       break;
-    case IrOpcode::kStoreBuffer:
-      break;
     case IrOpcode::kStoreElement:
       // (Object, elementtype) -> _|_
       // TODO(rossberg): activate once machine ops are typed.