[crankshaft] Remove for-in slow mode deopt loop.

src/crankshaft/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/crankshaft/hydrogen.h"
 
 #include <sstream>
 
 #include "src/allocation-site-scopes.h"
 #include "src/ast/ast-numbering.h"
@@ skipping 5293 matching lines @@
       enumerable, graph()->GetConstantNull());
   if_undefined_or_null.ThenDeopt(Deoptimizer::kUndefinedOrNullInForIn);
   if_undefined_or_null.End();
   BuildForInBody(stmt, each_var, enumerable);
 }
 
 
 void HOptimizedGraphBuilder::BuildForInBody(ForInStatement* stmt,
                                             Variable* each_var,
                                             HValue* enumerable) {
-  HInstruction* map;
-  HInstruction* array;
-  HInstruction* enum_length;
+  HValue* map;
+  HValue* array;
+  HValue* enum_length;
+  Handle<Map> meta_map = isolate()->factory()->meta_map();
+  bool fast = stmt->for_in_type() == ForInStatement::FAST_FOR_IN;
   BuildCheckHeapObject(enumerable);
   Add<HCheckInstanceType>(enumerable, HCheckInstanceType::IS_JS_RECEIVER);
   Add<HSimulate>(stmt->ToObjectId());
-  bool fast = stmt->for_in_type() == ForInStatement::FAST_FOR_IN;
   if (fast) {
     map = Add<HForInPrepareMap>(enumerable);
     Push(map);
     Add<HSimulate>(stmt->EnumId());
     Drop(1);
-    Handle<Map> meta_map = isolate()->factory()->meta_map();
     Add<HCheckMaps>(map, meta_map);
 
     array = Add<HForInCacheArray>(enumerable, map,
                                   DescriptorArray::kEnumCacheBridgeCacheIndex);
     enum_length = Add<HMapEnumLength>(map);
 
     HInstruction* index_cache = Add<HForInCacheArray>(
         enumerable, map, DescriptorArray::kEnumCacheBridgeIndicesCacheIndex);
     HForInCacheArray::cast(array)
         ->set_index_cache(HForInCacheArray::cast(index_cache));
   } else {
-    map = graph()->GetConstant1();
     Runtime::FunctionId function_id = Runtime::kGetPropertyNamesFast;
     Add<HPushArguments>(enumerable);
     array = Add<HCallRuntime>(Runtime::FunctionForId(function_id), 1);
     Push(array);
     Add<HSimulate>(stmt->EnumId());
     Drop(1);
-    Handle<Map> array_map = isolate()->factory()->fixed_array_map();
-    HValue* check = Add<HCheckMaps>(array, array_map);
-    enum_length = AddLoadFixedArrayLength(array, check);
+    {
+      NoObservableSideEffectsScope scope(this);
+      IfBuilder if_fast(this);
+      if_fast.If<HCompareMap>(array, meta_map);
+      if_fast.Then();
+      {
+        HValue* cache_map = array;
+        HForInCacheArray* cache = Add<HForInCacheArray>(
+            enumerable, cache_map, DescriptorArray::kEnumCacheBridgeCacheIndex);
+        enum_length = Add<HMapEnumLength>(cache_map);
+        Push(cache_map);

[Jakob Kummerow, 2016/01/28 21:34:38]

Pushing the map here has no effect, as we're in the fast==false case (see lines
5322/5337 above), whereas the map check that would consume it is only emitted in
the fast==true case (see line 5412 below).

+        Push(cache);
+        Push(enum_length);
+      }
+      if_fast.Else();
+      {
+        Push(graph()->GetConstant1());
+        Push(array);
+        Push(AddLoadFixedArrayLength(array));
+      }
+      if_fast.End();
+      enum_length = Pop();
+      array = Pop();
+      map = Pop();
+    }
   }
 
   HInstruction* start_index = Add<HConstant>(0);
 
   Push(map);
   Push(array);
   Push(enum_length);
   Push(start_index);
 
   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
@@ skipping 8229 matching lines @@
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8