Introduce {FAST,SLOW}_STRING_WRAPPER_ELEMENTS

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index de5817188d95db5b9c63cb773f8592b0e08ad5ab..e05a4dd45a98a38c8fc11e8f95f4ca1685a769cd 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -835,14 +835,20 @@ uint32_t EstimateElementCount(Handle<JSArray> array) {
       }
       break;
     }
-    case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
-    case SLOW_SLOPPY_ARGUMENTS_ELEMENTS:
 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) case TYPE##_ELEMENTS:
 
       TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
       // External arrays are always dense.
       return length;
+    case NO_ELEMENTS:
+      return 0;
+    case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
+    case SLOW_SLOPPY_ARGUMENTS_ELEMENTS:
+    case FAST_STRING_WRAPPER_ELEMENTS:
+    case SLOW_STRING_WRAPPER_ELEMENTS:
+      UNREACHABLE();
+      return 0;
   }
   // As an estimate, we assume that the prototype doesn't contain any
   // inherited elements.
@@ -983,6 +989,28 @@ void CollectElementIndices(Handle<JSObject> object, uint32_t range,
       }
       break;
     }
+    case FAST_STRING_WRAPPER_ELEMENTS:
+    case SLOW_STRING_WRAPPER_ELEMENTS: {
+      DCHECK(object->IsJSValue());
+      Handle<JSValue> js_value = Handle<JSValue>::cast(object);
+      DCHECK(js_value->value()->IsString());
+      Handle<String> string(String::cast(js_value->value()), isolate);
+      uint32_t length = static_cast<uint32_t>(string->length());
+      uint32_t i = 0;
+      uint32_t limit = Min(length, range);
+      for (; i < limit; i++) {
+        indices->Add(i);
+      }
+      ElementsAccessor* accessor = object->GetElementsAccessor();
+      for (; i < range; i++) {
+        if (accessor->HasElement(object, i)) {
+          indices->Add(i);
+        }
+      }
+      break;
+    }
+    case NO_ELEMENTS:
+      break;
   }
 
   PrototypeIterator iter(isolate, object);
@@ -1218,6 +1246,13 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
       }
       break;
     }
+    case NO_ELEMENTS:
+      break;
+    case FAST_STRING_WRAPPER_ELEMENTS:
+    case SLOW_STRING_WRAPPER_ELEMENTS:
+      // |array| is guaranteed to be an array or typed array.
+      UNREACHABLE();
+      break;
   }
   visitor->increase_index_offset(length);
   return true;
@@ -1367,6 +1402,7 @@ Object* Slow_ArrayConcat(Arguments* args, Handle<Object> species,
             case FAST_HOLEY_ELEMENTS:
             case FAST_ELEMENTS:
             case DICTIONARY_ELEMENTS:
+            case NO_ELEMENTS:
               DCHECK_EQ(0u, length);
               break;
             default:
@@ -1728,7 +1764,7 @@ BUILTIN(ObjectValues) {
                           CONVERT_TO_STRING));
 
   for (int i = 0; i < keys->length(); ++i) {
-    auto key = Handle<Name>::cast(FixedArray::get(keys, i));
+    auto key = Handle<Name>::cast(FixedArray::get(*keys, i, isolate));
     Handle<Object> value;
 
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
@@ -1754,7 +1790,7 @@ BUILTIN(ObjectEntries) {
                           CONVERT_TO_STRING));
 
   for (int i = 0; i < keys->length(); ++i) {
-    auto key = Handle<Name>::cast(FixedArray::get(keys, i));
+    auto key = Handle<Name>::cast(FixedArray::get(*keys, i, isolate));
     Handle<Object> value;
 
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(