[turbofan] inline %StringIteratorPrototype%.next in JSBuiltinReducer.

src/compiler/access-builder.cc

Index: src/compiler/access-builder.cc
diff --git a/src/compiler/access-builder.cc b/src/compiler/access-builder.cc
index f99f51ae236e1166cb09462b0141b3f939186405..396ab20d6b2d5b4098cd99a827d536faf6359574 100644
--- a/src/compiler/access-builder.cc
+++ b/src/compiler/access-builder.cc
@@ -548,6 +548,22 @@ FieldAccess AccessBuilder::ForJSGlobalObjectNativeContext() {
   return access;
 }
 
+// static
+FieldAccess AccessBuilder::ForJSStringIteratorString() {
+  FieldAccess access = {
+      kTaggedBase,    JSStringIterator::kStringOffset, Handle<String>(),
+      Type::String(), MachineType::TaggedPointer(),    kNoWriteBarrier};

[Benedikt Meurer, 2016/09/29 13:04:27]

This should be kPointerWriteBarrier.

+  return access;
+}
+
+// static
+FieldAccess AccessBuilder::ForJSStringIteratorIndex() {
+  FieldAccess access = {
+      kTaggedBase,          JSStringIterator::kNextIndexOffset,
+      Handle<String>(),     Type::Signed32(),

[Benedikt Meurer, 2016/09/29 13:04:26]

The type of this field is Type::UnsignedSmall(), as it can only contain positive
Smis. Actually it can only contain Smis in the range [0, String::kMaxLength], so
this should be TypeCache::Get().kStringLengthType instead.

+      MachineType::Int32(), kNoWriteBarrier};

[Benedikt Meurer, 2016/09/29 13:04:27]

This should be MachineType::TaggedSigned() instead of MachineType::Int32().

+  return access;
+}
 
 // static
 FieldAccess AccessBuilder::ForValue() {