[Interpreter] Add support for for..in.

src/runtime/runtime-interpreter.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/isolate-inl.h"
 
 namespace v8 {
@@ skipping 129 matching lines @@
 RUNTIME_FUNCTION(Runtime_InterpreterNewClosure) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(SharedFunctionInfo, shared, 0);
   CONVERT_SMI_ARG_CHECKED(pretenured_flag, 1);
   Handle<Context> context(isolate->context(), isolate);
   return *isolate->factory()->NewFunctionFromSharedFunctionInfo(
       shared, context, static_cast<PretenureFlag>(pretenured_flag));
 }
 
+
+namespace {
+
+HeapObject* GetPropertyNamesFast(Handle<JSReceiver> raw_object,
+                                 Isolate* isolate) {
+  // REVIEW(oth): should we be calling the existing runtime method
+  // rather than re-implementing here.
+  SealHandleScope shs(isolate);
+
+  if (raw_object->IsSimpleEnum()) return raw_object->map();
+
+  HandleScope scope(isolate);
+  Handle<FixedArray> content;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, content,
+      JSReceiver::GetKeys(raw_object, JSReceiver::INCLUDE_PROTOS));
+
+  // Test again, since cache may have been built by preceding call.
+  if (raw_object->IsSimpleEnum()) return raw_object->map();
+
+  return *content;
+}
+
+}  // namespace
+
+
+RUNTIME_FUNCTION(Runtime_InterpreterForInPrepare) {

[Benedikt Meurer, 2015/10/26 12:17:37]

Is this is a temporary thing? Because this runtime function will not do the
trick, as we need to be able to lazy deopt after the ToObject for example, or
the GetPropertyNamesFast.

[oth, 2015/10/28 11:53:12]

Yes, good points - I was not thinking about this. The revised code calls the
runtime for GetPropertyNamesFast at the bytecode level and uses a ToObject
bytecode. 

[Benedikt Meurer, 2015/10/28 12:03:31]

Ack. Thanks.

+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
+
+  // First check if object is null or undefined.
+  if (object->IsNull() || object->IsUndefined()) {
+    return isolate->heap()->undefined_value();
+  }
+
+  Handle<JSReceiver> receiver;
+  if (!JSReceiver::ToObject(isolate, object).ToHandle(&receiver)) {
+    return isolate->heap()->undefined_value();
+  }
+
+  Handle<Object> cache_type =
+      handle(GetPropertyNamesFast(receiver, isolate), isolate);
+  Handle<Map> cache_type_map =
+      handle(Handle<HeapObject>::cast(cache_type)->map(), isolate);
+  Handle<Map> receiver_map = handle(receiver->map(), isolate);
+
+  Handle<FixedArray> cache_array;
+  int cache_length;
+
+  if (cache_type_map.is_identical_to(isolate->factory()->meta_map())) {
+    cache_length = cache_type_map->EnumLength();
+    if (cache_length > 0) {
+      DescriptorArray* descriptors = receiver_map->instance_descriptors();
+      cache_array = handle(descriptors->GetEnumCache(), isolate);
+    } else {
+      cache_array = isolate->factory()->empty_fixed_array();
+    }
+  } else {
+    cache_array = Handle<FixedArray>::cast(cache_type);
+    cache_length = cache_array->length();
+
+    STATIC_ASSERT(FIRST_JS_PROXY_TYPE == FIRST_SPEC_OBJECT_TYPE);
+    if (receiver_map->instance_type() <= LAST_JS_PROXY_TYPE) {
+      DCHECK_GE(receiver_map->instance_type(), LAST_JS_PROXY_TYPE);
+      // Zero indicates proxy
+      cache_type = Handle<Object>(Smi::FromInt(0), isolate);
+    } else {
+      // One entails slow check
+      cache_type = Handle<Object>(Smi::FromInt(1), isolate);
+    }
+  }
+
+  Handle<FixedArray> result = isolate->factory()->NewFixedArray(4);
+  result->set(0, *receiver);
+  result->set(1, *cache_array);
+  result->set(2, *cache_type);
+  result->set(3, Smi::FromInt(cache_length));
+  return *result;
+}
+
+
 }  // namespace internal
 }  // namespace v8