[builtins] implement Array.prototype[@@iterator] in TFJ builtins

src/builtins/builtins-array.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins.h"
 #include "src/builtins/builtins-utils.h"
 
 #include "src/code-factory.h"
+#include "src/contexts.h"
 #include "src/elements.h"
 
 namespace v8 {
 namespace internal {
 
 namespace {
 
 inline bool ClampedToInteger(Isolate* isolate, Object* object, int* out) {
   // This is an extended version of ECMA-262 7.1.11 handling signed values
   // Try to convert object to a number and clamp values to [kMinInt, kMaxInt]
@@ skipping 2041 matching lines @@
   assembler->Return(assembler->ChangeInt32ToTagged(index_var.value()));
 
   assembler->Bind(&return_not_found);
   assembler->Return(assembler->NumberConstant(-1));
 
   assembler->Bind(&call_runtime);
   assembler->Return(assembler->CallRuntime(Runtime::kArrayIndexOf, context,
                                            array, search_element, start_from));
 }
 
+namespace {
+
+template <IterationKind kIterationKind>
+void Generate_ArrayPrototypeIterationMethod(CodeStubAssembler* assembler) {
+  typedef compiler::Node Node;
+  typedef CodeStubAssembler::Label Label;
+  typedef CodeStubAssembler::Variable Variable;
+
+  Node* receiver = assembler->Parameter(0);
+  Node* context = assembler->Parameter(3);
+
+  Variable var_array(assembler, MachineRepresentation::kTagged);
+  Variable var_map(assembler, MachineRepresentation::kTagged);
+  Variable var_type(assembler, MachineRepresentation::kWord32);
+
+  Label if_isnotobject(assembler, Label::kDeferred);
+  Label create_array_iterator(assembler);
+
+  assembler->GotoIf(assembler->TaggedIsSmi(receiver), &if_isnotobject);
+  var_array.Bind(receiver);
+  var_map.Bind(assembler->LoadMap(receiver));
+  var_type.Bind(assembler->LoadMapInstanceType(var_map.value()));
+  assembler->Branch(

[Benedikt Meurer, 2016/10/14 03:46:50]

You can use CodeStubAssembler::IsJSReceiverInstanceType here.

+      assembler->Int32LessThan(
+          var_type.value(), assembler->Int32Constant(FIRST_JS_RECEIVER_TYPE)),
+      &if_isnotobject, &create_array_iterator);
+
+  assembler->Bind(&if_isnotobject);
+  {
+    Callable callable = CodeFactory::ToObject(assembler->isolate());
+    Node* result = assembler->CallStub(callable, context, receiver);
+    var_array.Bind(result);
+    var_map.Bind(assembler->LoadMap(result));
+    var_type.Bind(assembler->LoadMapInstanceType(var_map.value()));
+    assembler->Goto(&create_array_iterator);
+  }
+
+  assembler->Bind(&create_array_iterator);
+  assembler->Return(assembler->CreateArrayIterator(
+      var_array.value(), var_map.value(), var_type.value(), context,
+      kIterationKind));
+}
+}  // namespace
+
+void Builtins::Generate_ArrayPrototypeValues(CodeStubAssembler* assembler) {
+  Generate_ArrayPrototypeIterationMethod<IterationKind::kValues>(assembler);
+}
+
+void Builtins::Generate_ArrayPrototypeEntries(CodeStubAssembler* assembler) {
+  Generate_ArrayPrototypeIterationMethod<IterationKind::kEntries>(assembler);
+}
+
+void Builtins::Generate_ArrayPrototypeKeys(CodeStubAssembler* assembler) {
+  Generate_ArrayPrototypeIterationMethod<IterationKind::kKeys>(assembler);
+}
+
+void Builtins::Generate_ArrayIteratorPrototypeNext(
+    CodeStubAssembler* assembler) {
+  typedef compiler::Node Node;
+  typedef CodeStubAssembler::Label Label;
+  typedef CodeStubAssembler::Variable Variable;
+
+  Variable var_value(assembler, MachineRepresentation::kTagged);
+  Variable var_done(assembler, MachineRepresentation::kTagged);
+  Variable var_result(assembler, MachineRepresentation::kTagged);
+
+  Label set_done_and_return(assembler);
+  Label did_set_done(assembler);
+  Label allocate_entry_if_needed(assembler);
+  Label allocate_iterator_result(assembler);
+  Label throw_bad_receiver(assembler);
+
+  Label if_isarray(assembler);
+  Label if_istypedarray(assembler);
+  Label if_slow(assembler);
+  Label if_slownotkeyiterator(assembler);
+
+  Node* iterator = assembler->Parameter(0);
+  Node* context = assembler->Parameter(3);
+
+  // If O does not have all of the internal slots of an Array Iterator Instance
+  // (22.1.5.3), throw a TypeError exception
+  assembler->GotoIf(assembler->TaggedIsSmi(iterator), &throw_bad_receiver);
+  Node* instance_type = assembler->LoadInstanceType(iterator);
+  assembler->GotoIf(
+      assembler->Uint32LessThan(
+          assembler->Int32Constant(LAST_ARRAY_ITERATOR_TYPE -
+                                   FIRST_ARRAY_ITERATOR_TYPE),
+          assembler->Int32Sub(instance_type, assembler->Int32Constant(
+                                                 FIRST_ARRAY_ITERATOR_TYPE))),
+      &throw_bad_receiver);
+
+  // Let a be O.[[IteratedObject]].
+  STATIC_ASSERT(JSArrayIterator::kIteratedObjectOffset ==
+                JSTypedArrayIterator::kIteratedObjectOffset);
+  Node* array = assembler->LoadObjectField(
+      iterator, JSArrayIterator::kIteratedObjectOffset);
+
+  // If a is undefined, return CreateIterResultObject(undefined, true)
+  assembler->GotoIf(assembler->WordEqual(array, assembler->UndefinedConstant()),
+                    &did_set_done);
+
+  // Let index be O.[[ArrayIteratorNextIndex]].
+  STATIC_ASSERT(JSArrayIterator::kNextIndexOffset ==
+                JSTypedArrayIterator::kNextIndexOffset);
+  Node* index =
+      assembler->LoadObjectField(iterator, JSArrayIterator::kNextIndexOffset);
+
+  Node* array_map = assembler->LoadMap(array);
+  Node* array_type = assembler->LoadMapInstanceType(array_map);
+
+  Variable var_length(assembler, MachineRepresentation::kTagged);
+  Variable var_orig_map(assembler, MachineRepresentation::kTagged);
+  Variable var_typed_elements(assembler, MachineType::PointerRepresentation());
+  Variable var_elements(assembler, MachineRepresentation::kTagged);
+  var_orig_map.Bind(assembler->UndefinedConstant());
+  var_typed_elements.Bind(assembler->IntPtrConstant(0));
+  var_elements.Bind(assembler->LoadElements(array));
+  {
+    Label load_array_length(assembler), load_typedarray_length(assembler),
+        load_length_slow(assembler), did_get_length(assembler),
+        did_increment_next_index(assembler);
+    assembler->GotoIf(assembler->Word32Equal(

[Benedikt Meurer, 2016/10/14 03:46:50]

What is the motivation to not do a big switch on the iterator instance type? Do
you think it would be too slow/bad for cache?

For example:

var index = iterator->index;
var done = true;
var value = undefined;
switch (iterator->instance_type) {
 case FAST_JSARRAY_KEY: {
  if (object->map != iterator->object_map) goto generic_key;
  if (SmiLessThan(index, object->length)) {
   done = false;
   value = index;
   index = SmiInc(index);
  }
  break;
 }
 case FAST_JSARRAY_SMI_VALUE: {
  if (object->map != iterator->object_map) goto generic_value;
  if (SmiLessThan(index, object->length)) {
   done = false;
   value = object[index];
   index = SmiInc(index);
  }
  break;
 }
...
 case GENERIC_JSARRAY_KEY:
 generic_key: {
  length = ToLengthStub(GetPropertyStub(object, "length"));
  if (NumberLessThan(index, length)) {
    done = false;
    value = index;
    index = NumberInc(index);
  }
  break;
 }
}
iterator->index = index;
return CreateIterResultObject(done,value);


Not saying you have to/should do it this way. Just wondering if this would be
easier and faster? (given some generator helper functions)

[caitp, 2016/10/14 03:57:15]

I suppose there's no reason not to do it, other than taking up more memory and
not necessarily adding that much in terms of performance (but I'll give it a try
to see, I suppose)

[Benedikt Meurer, 2016/10/14 04:11:18]

As said, I'm perfectly happy if you say the other solution is better for
reasons.

+                          array_type, assembler->Int32Constant(JS_ARRAY_TYPE)),
+                      &load_array_length);
+    assembler->Branch(
+        assembler->Word32Equal(array_type,
+                               assembler->Int32Constant(JS_TYPED_ARRAY_TYPE)),
+        &load_typedarray_length, &load_length_slow);
+
+    assembler->Bind(&load_array_length);
+    {
+      var_orig_map.Bind(assembler->LoadObjectField(
+          iterator, JSArrayIterator::kIteratedObjectMapOffset));
+      var_length.Bind(
+          assembler->LoadObjectField(array, JSArray::kLengthOffset));

[Benedikt Meurer, 2016/10/14 03:46:50]

This is only valid if the array map didn't change (and you previously checked
that it's fast, and length was not messed up). You have to do the map check
first, otherwise it's not guaranteed that the JSArray::length access gives you
the value that you'd get when loading "length".

[caitp, 2016/10/14 03:57:15]

I don't think it's possible to alter the way "length" works for Array exotic
objects, per spec (EG step 10 of ArrayCreate(), Perform !
OrdinaryDefineOwnProperty(A, "length", PropertyDescriptor{[[Value]]: length,
[[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: false})). This is
always an own property, so it doesn't matter if an accessor is installed on a
subclass or anything.

If instance_type is JS_ARRAY_TYPE, loading the in object "length" field should
be sound

[Benedikt Meurer, 2016/10/14 04:11:18]

Ah, indeed, you are right.

Ok, so this reduces to the question of whether to do the big switch and only a
map check, or your solution with an instance type check on the object first, and
then only do the map check for the value and value/key iterators.

I'd fine with either; whatever is easier / more efficient.

+      assembler->Goto(&did_get_length);
+    }
+
+    assembler->Bind(&load_typedarray_length);
+    {
+      assembler->Assert(assembler->TaggedIsSmi(index));
+      var_typed_elements.Bind(assembler->IntPtrAdd(
+          assembler->LoadObjectField(var_elements.value(),
+                                     FixedTypedArrayBase::kBasePointerOffset),
+          assembler->LoadObjectField(
+              var_elements.value(),
+              FixedTypedArrayBase::kExternalPointerOffset)));
+      var_length.Bind(
+          assembler->LoadObjectField(array, JSTypedArray::kLengthOffset));
+      assembler->Goto(&did_get_length);
+    }
+
+    assembler->Bind(&load_length_slow);
+    {
+      Node* length_string = assembler->HeapConstant(
+          assembler->isolate()->factory()->length_string());
+      Callable get_length = CodeFactory::GetProperty(assembler->isolate());
+      Node* length =
+          assembler->CallStub(get_length, context, array, length_string);
+      Callable to_length = CodeFactory::ToLength(assembler->isolate());
+      var_length.Bind(assembler->CallStub(to_length, context, length));
+      assembler->Goto(&did_get_length);
+    }
+
+    assembler->Bind(&did_get_length);
+    {
+      Label if_notdone(assembler), if_smi(assembler), if_heapnum(assembler);
+      Node* length = var_length.value();
+      assembler->Branch(assembler->TaggedIsSmi(length), &if_smi, &if_heapnum);
+
+      assembler->Bind(&if_smi);
+      {
+        // Are these shortcuts valid?
+        assembler->GotoUnless(assembler->TaggedIsSmi(index),
+                              &set_done_and_return);
+        assembler->Branch(assembler->SmiBelow(index, length), &if_notdone,
+                          &set_done_and_return);
+      }
+
+      assembler->Bind(&if_heapnum);
+      {
+        // Are these shortcuts valid?
+        assembler->GotoIf(assembler->TaggedIsSmi(index), &if_notdone);
+        assembler->Branch(
+            assembler->Float64LessThan(assembler->LoadHeapNumberValue(index),
+                                       assembler->LoadHeapNumberValue(length)),
+            &if_notdone, &set_done_and_return);
+      }
+
+      assembler->Bind(&if_notdone);
+      assembler->StoreObjectFieldNoWriteBarrier(
+          iterator, JSStringIterator::kNextIndexOffset,
+          assembler->NumberInc(index));
+
+      assembler->Goto(&did_increment_next_index);
+    }
+
+    assembler->Bind(&did_increment_next_index);
+    var_done.Bind(assembler->BooleanConstant(false));
+  }
+
+  static int32_t kInstanceType[] = {
+      JS_TYPED_ARRAY_KEY_ITERATOR_TYPE,
+      JS_GENERIC_ARRAY_KEY_ITERATOR_TYPE,
+
+      JS_UINT8_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_INT8_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_UINT16_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_INT16_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_UINT32_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_INT32_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FLOAT32_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FLOAT64_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_UINT8_CLAMPED_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+
+      JS_FAST_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FAST_HOLEY_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FAST_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FAST_HOLEY_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FAST_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FAST_HOLEY_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_GENERIC_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+
+      JS_UINT8_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_INT8_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_UINT16_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_INT16_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_UINT32_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_INT32_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FLOAT32_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FLOAT64_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_UINT8_CLAMPED_ARRAY_VALUE_ITERATOR_TYPE,
+
+      JS_FAST_SMI_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FAST_HOLEY_SMI_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FAST_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FAST_HOLEY_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FAST_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FAST_HOLEY_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_GENERIC_ARRAY_VALUE_ITERATOR_TYPE};
+
+  Label keys(assembler, Label::kDeferred);
+  Label object_values(assembler, Label::kDeferred);
+  Label double_values(assembler, Label::kDeferred);
+  Label generic_values(assembler, Label::kDeferred);
+  Label uint8_values(assembler, Label::kDeferred);
+  Label int8_values(assembler, Label::kDeferred);
+  Label uint16_values(assembler, Label::kDeferred);
+  Label int16_values(assembler, Label::kDeferred);
+  Label uint32_values(assembler, Label::kDeferred);
+  Label int32_values(assembler, Label::kDeferred);
+  Label float32_values(assembler, Label::kDeferred);
+  Label float64_values(assembler, Label::kDeferred);
+
+  Label* kInstanceTypeHandlers[] = {
+      &keys,           &keys,           &uint8_values,  &int8_values,
+      &uint16_values,  &int16_values,   &uint32_values, &int32_values,
+      &float32_values, &float64_values, &uint8_values,  &object_values,
+      &object_values,  &object_values,  &object_values, &double_values,
+      &double_values,  &generic_values, &uint8_values,  &int8_values,
+      &uint16_values,  &int16_values,   &uint32_values, &int32_values,
+      &float32_values, &float64_values, &uint8_values,  &object_values,
+      &object_values,  &object_values,  &object_values, &double_values,
+      &double_values,  &generic_values,
+  };
+
+  assembler->Switch(instance_type, &set_done_and_return, kInstanceType,
+                    kInstanceTypeHandlers, arraysize(kInstanceType));
+
+  assembler->Bind(&keys);
+  {
+    var_value.Bind(index);
+    assembler->Goto(&allocate_iterator_result);
+  }
+
+  assembler->Bind(&object_values);
+  {
+    assembler->GotoIf(assembler->WordNotEqual(var_orig_map.value(), array_map),
+                      &generic_values);
+
+    Label is_smi(assembler), is_heapnum(assembler), do_load(assembler);
+    Variable var_idx(assembler, MachineRepresentation::kWord32);
+
+    assembler->Branch(assembler->TaggedIsSmi(index), &is_smi, &is_heapnum);
+
+    assembler->Bind(&is_smi);
+    {
+      var_idx.Bind(assembler->SmiToWord32(index));
+      assembler->Goto(&do_load);
+    }
+
+    assembler->Bind(&is_heapnum);
+    {
+      var_idx.Bind(assembler->TruncateFloat64ToWord32(
+          assembler->LoadHeapNumberValue(index)));
+      assembler->Goto(&do_load);
+    }
+
+    assembler->Bind(&do_load);
+    var_value.Bind(assembler->LoadFixedArrayElement(var_elements.value(),
+                                                    var_idx.value(), 0));
+    assembler->GotoUnless(
+        assembler->WordEqual(var_value.value(), assembler->TheHoleConstant()),
+        &allocate_entry_if_needed);
+    var_value.Bind(assembler->UndefinedConstant());
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&double_values);
+  {
+    assembler->GotoIf(assembler->WordNotEqual(var_orig_map.value(), array_map),
+                      &generic_values);
+
+    Label is_smi(assembler), is_heapnum(assembler), do_load(assembler);
+    Variable var_idx(assembler, MachineRepresentation::kWord32);
+
+    assembler->Branch(assembler->TaggedIsSmi(index), &is_smi, &is_heapnum);
+
+    assembler->Bind(&is_smi);
+    {
+      var_idx.Bind(assembler->SmiToWord32(index));
+      assembler->Goto(&do_load);
+    }
+
+    assembler->Bind(&is_heapnum);
+    {
+      var_idx.Bind(assembler->TruncateFloat64ToWord32(
+          assembler->LoadHeapNumberValue(index)));
+      assembler->Goto(&do_load);
+    }
+
+    assembler->Bind(&do_load);
+    var_value.Bind(assembler->UndefinedConstant());
+    Node* value = assembler->LoadFixedDoubleArrayElement(
+        var_elements.value(), var_idx.value(), MachineType::Float64(), 0,
+        CodeStubAssembler::INTEGER_PARAMETERS, &allocate_entry_if_needed);
+    var_value.Bind(assembler->AllocateHeapNumberWithValue(value));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&generic_values);
+  {
+    Callable callable = CodeFactory::GetProperty(assembler->isolate());
+    var_value.Bind(assembler->CallStub(callable, context, array, index));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&uint8_values);
+  {
+    Node* value_uint8 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, UINT8_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->SmiFromWord(value_uint8));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&int8_values);
+  {
+    Node* value_int8 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, INT8_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->SmiFromWord(value_int8));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&uint16_values);
+  {
+    Node* value_uint16 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, UINT16_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->SmiFromWord(value_uint16));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&int16_values);
+  {
+    Node* value_int16 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, INT16_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->SmiFromWord(value_int16));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&uint32_values);
+  {
+    Node* value_uint32 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, UINT32_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->ChangeUint32ToTagged(value_uint32));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+  assembler->Bind(&int32_values);
+  {
+    Node* value_int32 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, INT32_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->ChangeInt32ToTagged(value_int32));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+  assembler->Bind(&float32_values);
+  {
+    Node* value_float32 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, FLOAT32_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->AllocateHeapNumberWithValue(
+        assembler->ChangeFloat32ToFloat64(value_float32)));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+  assembler->Bind(&float64_values);
+  {
+    Node* value_float64 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, FLOAT64_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->AllocateHeapNumberWithValue(value_float64));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&set_done_and_return);
+  {
+    assembler->StoreObjectFieldNoWriteBarrier(
+        iterator, JSTypedArrayIterator::kIteratedObjectOffset,
+        assembler->UndefinedConstant());
+    assembler->Goto(&did_set_done);
+    assembler->Bind(&did_set_done);
+    {
+      var_value.Bind(assembler->UndefinedConstant());
+      var_done.Bind(assembler->TrueConstant());
+      assembler->Goto(&allocate_iterator_result);
+    }
+  }
+
+  assembler->Bind(&allocate_entry_if_needed);
+  {
+    assembler->GotoIf(
+        assembler->Int32GreaterThan(
+            instance_type,
+            assembler->Int32Constant(LAST_ARRAY_KEY_VALUE_ITERATOR_TYPE)),
+        &allocate_iterator_result);
+    Node* elements = assembler->AllocateFixedArray(FAST_ELEMENTS,
+                                                   assembler->Int32Constant(2));
+    assembler->StoreFixedArrayElement(elements, assembler->Int32Constant(0),
+                                      index, SKIP_WRITE_BARRIER);
+    assembler->StoreFixedArrayElement(elements, assembler->Int32Constant(1),
+                                      var_value.value(), SKIP_WRITE_BARRIER);
+
+    Node* entry = assembler->Allocate(JSArray::kSize);
+    Node* map = assembler->LoadFixedArrayElement(
+        assembler->LoadNativeContext(context),
+        assembler->IntPtrConstant(Context::JS_ARRAY_FAST_ELEMENTS_MAP_INDEX), 0,
+        CodeStubAssembler::INTPTR_PARAMETERS);
+
+    assembler->StoreMapNoWriteBarrier(entry, map);
+    assembler->StoreObjectFieldRoot(entry, JSArray::kPropertiesOffset,
+                                    Heap::kEmptyFixedArrayRootIndex);
+    assembler->StoreObjectFieldNoWriteBarrier(entry, JSArray::kElementsOffset,
+                                              elements);
+    assembler->StoreObjectFieldNoWriteBarrier(
+        entry, JSArray::kLengthOffset, assembler->SmiConstant(Smi::FromInt(2)));
+
+    var_value.Bind(entry);
+    assembler->Goto(&allocate_iterator_result);
+  }
+
+  assembler->Bind(&allocate_iterator_result);
+  {
+    Node* result = assembler->Allocate(JSIteratorResult::kSize);
+    Node* map = assembler->LoadFixedArrayElement(
+        assembler->LoadNativeContext(context),
+        assembler->IntPtrConstant(Context::ITERATOR_RESULT_MAP_INDEX), 0,
+        CodeStubAssembler::INTPTR_PARAMETERS);
+    assembler->StoreMapNoWriteBarrier(result, map);
+    assembler->StoreObjectFieldRoot(result, JSIteratorResult::kPropertiesOffset,
+                                    Heap::kEmptyFixedArrayRootIndex);
+    assembler->StoreObjectFieldRoot(result, JSIteratorResult::kElementsOffset,
+                                    Heap::kEmptyFixedArrayRootIndex);
+    assembler->StoreObjectFieldNoWriteBarrier(
+        result, JSIteratorResult::kValueOffset, var_value.value());
+    assembler->StoreObjectFieldNoWriteBarrier(
+        result, JSIteratorResult::kDoneOffset, var_done.value());
+    assembler->Return(result);
+  }
+
+  assembler->Bind(&throw_bad_receiver);
+  {
+    // The {receiver} is not a valid JSArrayIterator or JSTypedArrayIterator.
+    Node* result = assembler->CallRuntime(
+        Runtime::kThrowIncompatibleMethodReceiver, context,
+        assembler->HeapConstant(assembler->factory()->NewStringFromAsciiChecked(
+            "Array Iterator.prototype.next", TENURED)),
+        iterator);
+    assembler->Return(result);
+  }
+}
+
 }  // namespace internal
 }  // namespace v8