[builtins] implement Array.prototype[@@iterator] in TFJ builtins

src/builtins/builtins-array.cc

Index: src/builtins/builtins-array.cc
diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
index b5190e66bc9d1b1d9dc37e6b3bece61ccf5be399..ad8362a63d6215223460f6c66bb274fe8912aadd 100644
--- a/src/builtins/builtins-array.cc
+++ b/src/builtins/builtins-array.cc
@@ -6,6 +6,7 @@
 #include "src/builtins/builtins-utils.h"
 
 #include "src/code-factory.h"
+#include "src/contexts.h"
 #include "src/elements.h"
 
 namespace v8 {
@@ -2067,5 +2068,500 @@ void Builtins::Generate_ArrayIndexOf(CodeStubAssembler* assembler) {
                                            array, search_element, start_from));
 }
 
+namespace {
+
+template <IterationKind kIterationKind>
+void Generate_ArrayPrototypeIterationMethod(CodeStubAssembler* assembler) {
+  typedef compiler::Node Node;
+  typedef CodeStubAssembler::Label Label;
+  typedef CodeStubAssembler::Variable Variable;
+
+  Node* receiver = assembler->Parameter(0);
+  Node* context = assembler->Parameter(3);
+
+  Variable var_array(assembler, MachineRepresentation::kTagged);
+  Variable var_map(assembler, MachineRepresentation::kTagged);
+  Variable var_type(assembler, MachineRepresentation::kWord32);
+
+  Label if_isnotobject(assembler, Label::kDeferred);
+  Label create_array_iterator(assembler);
+
+  assembler->GotoIf(assembler->TaggedIsSmi(receiver), &if_isnotobject);
+  var_array.Bind(receiver);
+  var_map.Bind(assembler->LoadMap(receiver));
+  var_type.Bind(assembler->LoadMapInstanceType(var_map.value()));
+  assembler->Branch(

[Benedikt Meurer, 2016/10/14 03:46:50]

You can use CodeStubAssembler::IsJSReceiverInstanceType here.

+      assembler->Int32LessThan(
+          var_type.value(), assembler->Int32Constant(FIRST_JS_RECEIVER_TYPE)),
+      &if_isnotobject, &create_array_iterator);
+
+  assembler->Bind(&if_isnotobject);
+  {
+    Callable callable = CodeFactory::ToObject(assembler->isolate());
+    Node* result = assembler->CallStub(callable, context, receiver);
+    var_array.Bind(result);
+    var_map.Bind(assembler->LoadMap(result));
+    var_type.Bind(assembler->LoadMapInstanceType(var_map.value()));
+    assembler->Goto(&create_array_iterator);
+  }
+
+  assembler->Bind(&create_array_iterator);
+  assembler->Return(assembler->CreateArrayIterator(
+      var_array.value(), var_map.value(), var_type.value(), context,
+      kIterationKind));
+}
+}  // namespace
+
+void Builtins::Generate_ArrayPrototypeValues(CodeStubAssembler* assembler) {
+  Generate_ArrayPrototypeIterationMethod<IterationKind::kValues>(assembler);
+}
+
+void Builtins::Generate_ArrayPrototypeEntries(CodeStubAssembler* assembler) {
+  Generate_ArrayPrototypeIterationMethod<IterationKind::kEntries>(assembler);
+}
+
+void Builtins::Generate_ArrayPrototypeKeys(CodeStubAssembler* assembler) {
+  Generate_ArrayPrototypeIterationMethod<IterationKind::kKeys>(assembler);
+}
+
+void Builtins::Generate_ArrayIteratorPrototypeNext(
+    CodeStubAssembler* assembler) {
+  typedef compiler::Node Node;
+  typedef CodeStubAssembler::Label Label;
+  typedef CodeStubAssembler::Variable Variable;
+
+  Variable var_value(assembler, MachineRepresentation::kTagged);
+  Variable var_done(assembler, MachineRepresentation::kTagged);
+  Variable var_result(assembler, MachineRepresentation::kTagged);
+
+  Label set_done_and_return(assembler);
+  Label did_set_done(assembler);
+  Label allocate_entry_if_needed(assembler);
+  Label allocate_iterator_result(assembler);
+  Label throw_bad_receiver(assembler);
+
+  Label if_isarray(assembler);
+  Label if_istypedarray(assembler);
+  Label if_slow(assembler);
+  Label if_slownotkeyiterator(assembler);
+
+  Node* iterator = assembler->Parameter(0);
+  Node* context = assembler->Parameter(3);
+
+  // If O does not have all of the internal slots of an Array Iterator Instance
+  // (22.1.5.3), throw a TypeError exception
+  assembler->GotoIf(assembler->TaggedIsSmi(iterator), &throw_bad_receiver);
+  Node* instance_type = assembler->LoadInstanceType(iterator);
+  assembler->GotoIf(
+      assembler->Uint32LessThan(
+          assembler->Int32Constant(LAST_ARRAY_ITERATOR_TYPE -
+                                   FIRST_ARRAY_ITERATOR_TYPE),
+          assembler->Int32Sub(instance_type, assembler->Int32Constant(
+                                                 FIRST_ARRAY_ITERATOR_TYPE))),
+      &throw_bad_receiver);
+
+  // Let a be O.[[IteratedObject]].
+  STATIC_ASSERT(JSArrayIterator::kIteratedObjectOffset ==
+                JSTypedArrayIterator::kIteratedObjectOffset);
+  Node* array = assembler->LoadObjectField(
+      iterator, JSArrayIterator::kIteratedObjectOffset);
+
+  // If a is undefined, return CreateIterResultObject(undefined, true)
+  assembler->GotoIf(assembler->WordEqual(array, assembler->UndefinedConstant()),
+                    &did_set_done);
+
+  // Let index be O.[[ArrayIteratorNextIndex]].
+  STATIC_ASSERT(JSArrayIterator::kNextIndexOffset ==
+                JSTypedArrayIterator::kNextIndexOffset);
+  Node* index =
+      assembler->LoadObjectField(iterator, JSArrayIterator::kNextIndexOffset);
+
+  Node* array_map = assembler->LoadMap(array);
+  Node* array_type = assembler->LoadMapInstanceType(array_map);
+
+  Variable var_length(assembler, MachineRepresentation::kTagged);
+  Variable var_orig_map(assembler, MachineRepresentation::kTagged);
+  Variable var_typed_elements(assembler, MachineType::PointerRepresentation());
+  Variable var_elements(assembler, MachineRepresentation::kTagged);
+  var_orig_map.Bind(assembler->UndefinedConstant());
+  var_typed_elements.Bind(assembler->IntPtrConstant(0));
+  var_elements.Bind(assembler->LoadElements(array));
+  {
+    Label load_array_length(assembler), load_typedarray_length(assembler),
+        load_length_slow(assembler), did_get_length(assembler),
+        did_increment_next_index(assembler);
+    assembler->GotoIf(assembler->Word32Equal(

[Benedikt Meurer, 2016/10/14 03:46:50]

What is the motivation to not do a big switch on the iterator instance type? Do
you think it would be too slow/bad for cache?

For example:

var index = iterator->index;
var done = true;
var value = undefined;
switch (iterator->instance_type) {
 case FAST_JSARRAY_KEY: {
  if (object->map != iterator->object_map) goto generic_key;
  if (SmiLessThan(index, object->length)) {
   done = false;
   value = index;
   index = SmiInc(index);
  }
  break;
 }
 case FAST_JSARRAY_SMI_VALUE: {
  if (object->map != iterator->object_map) goto generic_value;
  if (SmiLessThan(index, object->length)) {
   done = false;
   value = object[index];
   index = SmiInc(index);
  }
  break;
 }
...
 case GENERIC_JSARRAY_KEY:
 generic_key: {
  length = ToLengthStub(GetPropertyStub(object, "length"));
  if (NumberLessThan(index, length)) {
    done = false;
    value = index;
    index = NumberInc(index);
  }
  break;
 }
}
iterator->index = index;
return CreateIterResultObject(done,value);


Not saying you have to/should do it this way. Just wondering if this would be
easier and faster? (given some generator helper functions)

[caitp, 2016/10/14 03:57:15]

I suppose there's no reason not to do it, other than taking up more memory and
not necessarily adding that much in terms of performance (but I'll give it a try
to see, I suppose)

[Benedikt Meurer, 2016/10/14 04:11:18]

As said, I'm perfectly happy if you say the other solution is better for
reasons.

+                          array_type, assembler->Int32Constant(JS_ARRAY_TYPE)),
+                      &load_array_length);
+    assembler->Branch(
+        assembler->Word32Equal(array_type,
+                               assembler->Int32Constant(JS_TYPED_ARRAY_TYPE)),
+        &load_typedarray_length, &load_length_slow);
+
+    assembler->Bind(&load_array_length);
+    {
+      var_orig_map.Bind(assembler->LoadObjectField(
+          iterator, JSArrayIterator::kIteratedObjectMapOffset));
+      var_length.Bind(
+          assembler->LoadObjectField(array, JSArray::kLengthOffset));

[Benedikt Meurer, 2016/10/14 03:46:50]

This is only valid if the array map didn't change (and you previously checked
that it's fast, and length was not messed up). You have to do the map check
first, otherwise it's not guaranteed that the JSArray::length access gives you
the value that you'd get when loading "length".

[caitp, 2016/10/14 03:57:15]

I don't think it's possible to alter the way "length" works for Array exotic
objects, per spec (EG step 10 of ArrayCreate(), Perform !
OrdinaryDefineOwnProperty(A, "length", PropertyDescriptor{[[Value]]: length,
[[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: false})). This is
always an own property, so it doesn't matter if an accessor is installed on a
subclass or anything.

If instance_type is JS_ARRAY_TYPE, loading the in object "length" field should
be sound

[Benedikt Meurer, 2016/10/14 04:11:18]

Ah, indeed, you are right.

Ok, so this reduces to the question of whether to do the big switch and only a
map check, or your solution with an instance type check on the object first, and
then only do the map check for the value and value/key iterators.

I'd fine with either; whatever is easier / more efficient.

+      assembler->Goto(&did_get_length);
+    }
+
+    assembler->Bind(&load_typedarray_length);
+    {
+      assembler->Assert(assembler->TaggedIsSmi(index));
+      var_typed_elements.Bind(assembler->IntPtrAdd(
+          assembler->LoadObjectField(var_elements.value(),
+                                     FixedTypedArrayBase::kBasePointerOffset),
+          assembler->LoadObjectField(
+              var_elements.value(),
+              FixedTypedArrayBase::kExternalPointerOffset)));
+      var_length.Bind(
+          assembler->LoadObjectField(array, JSTypedArray::kLengthOffset));
+      assembler->Goto(&did_get_length);
+    }
+
+    assembler->Bind(&load_length_slow);
+    {
+      Node* length_string = assembler->HeapConstant(
+          assembler->isolate()->factory()->length_string());
+      Callable get_length = CodeFactory::GetProperty(assembler->isolate());
+      Node* length =
+          assembler->CallStub(get_length, context, array, length_string);
+      Callable to_length = CodeFactory::ToLength(assembler->isolate());
+      var_length.Bind(assembler->CallStub(to_length, context, length));
+      assembler->Goto(&did_get_length);
+    }
+
+    assembler->Bind(&did_get_length);
+    {
+      Label if_notdone(assembler), if_smi(assembler), if_heapnum(assembler);
+      Node* length = var_length.value();
+      assembler->Branch(assembler->TaggedIsSmi(length), &if_smi, &if_heapnum);
+
+      assembler->Bind(&if_smi);
+      {
+        // Are these shortcuts valid?
+        assembler->GotoUnless(assembler->TaggedIsSmi(index),
+                              &set_done_and_return);
+        assembler->Branch(assembler->SmiBelow(index, length), &if_notdone,
+                          &set_done_and_return);
+      }
+
+      assembler->Bind(&if_heapnum);
+      {
+        // Are these shortcuts valid?
+        assembler->GotoIf(assembler->TaggedIsSmi(index), &if_notdone);
+        assembler->Branch(
+            assembler->Float64LessThan(assembler->LoadHeapNumberValue(index),
+                                       assembler->LoadHeapNumberValue(length)),
+            &if_notdone, &set_done_and_return);
+      }
+
+      assembler->Bind(&if_notdone);
+      assembler->StoreObjectFieldNoWriteBarrier(
+          iterator, JSStringIterator::kNextIndexOffset,
+          assembler->NumberInc(index));
+
+      assembler->Goto(&did_increment_next_index);
+    }
+
+    assembler->Bind(&did_increment_next_index);
+    var_done.Bind(assembler->BooleanConstant(false));
+  }
+
+  static int32_t kInstanceType[] = {
+      JS_TYPED_ARRAY_KEY_ITERATOR_TYPE,
+      JS_GENERIC_ARRAY_KEY_ITERATOR_TYPE,
+
+      JS_UINT8_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_INT8_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_UINT16_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_INT16_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_UINT32_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_INT32_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FLOAT32_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FLOAT64_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_UINT8_CLAMPED_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+
+      JS_FAST_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FAST_HOLEY_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FAST_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FAST_HOLEY_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FAST_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_FAST_HOLEY_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+      JS_GENERIC_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+
+      JS_UINT8_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_INT8_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_UINT16_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_INT16_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_UINT32_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_INT32_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FLOAT32_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FLOAT64_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_UINT8_CLAMPED_ARRAY_VALUE_ITERATOR_TYPE,
+
+      JS_FAST_SMI_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FAST_HOLEY_SMI_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FAST_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FAST_HOLEY_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FAST_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_FAST_HOLEY_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE,
+      JS_GENERIC_ARRAY_VALUE_ITERATOR_TYPE};
+
+  Label keys(assembler, Label::kDeferred);
+  Label object_values(assembler, Label::kDeferred);
+  Label double_values(assembler, Label::kDeferred);
+  Label generic_values(assembler, Label::kDeferred);
+  Label uint8_values(assembler, Label::kDeferred);
+  Label int8_values(assembler, Label::kDeferred);
+  Label uint16_values(assembler, Label::kDeferred);
+  Label int16_values(assembler, Label::kDeferred);
+  Label uint32_values(assembler, Label::kDeferred);
+  Label int32_values(assembler, Label::kDeferred);
+  Label float32_values(assembler, Label::kDeferred);
+  Label float64_values(assembler, Label::kDeferred);
+
+  Label* kInstanceTypeHandlers[] = {
+      &keys,           &keys,           &uint8_values,  &int8_values,
+      &uint16_values,  &int16_values,   &uint32_values, &int32_values,
+      &float32_values, &float64_values, &uint8_values,  &object_values,
+      &object_values,  &object_values,  &object_values, &double_values,
+      &double_values,  &generic_values, &uint8_values,  &int8_values,
+      &uint16_values,  &int16_values,   &uint32_values, &int32_values,
+      &float32_values, &float64_values, &uint8_values,  &object_values,
+      &object_values,  &object_values,  &object_values, &double_values,
+      &double_values,  &generic_values,
+  };
+
+  assembler->Switch(instance_type, &set_done_and_return, kInstanceType,
+                    kInstanceTypeHandlers, arraysize(kInstanceType));
+
+  assembler->Bind(&keys);
+  {
+    var_value.Bind(index);
+    assembler->Goto(&allocate_iterator_result);
+  }
+
+  assembler->Bind(&object_values);
+  {
+    assembler->GotoIf(assembler->WordNotEqual(var_orig_map.value(), array_map),
+                      &generic_values);
+
+    Label is_smi(assembler), is_heapnum(assembler), do_load(assembler);
+    Variable var_idx(assembler, MachineRepresentation::kWord32);
+
+    assembler->Branch(assembler->TaggedIsSmi(index), &is_smi, &is_heapnum);
+
+    assembler->Bind(&is_smi);
+    {
+      var_idx.Bind(assembler->SmiToWord32(index));
+      assembler->Goto(&do_load);
+    }
+
+    assembler->Bind(&is_heapnum);
+    {
+      var_idx.Bind(assembler->TruncateFloat64ToWord32(
+          assembler->LoadHeapNumberValue(index)));
+      assembler->Goto(&do_load);
+    }
+
+    assembler->Bind(&do_load);
+    var_value.Bind(assembler->LoadFixedArrayElement(var_elements.value(),
+                                                    var_idx.value(), 0));
+    assembler->GotoUnless(
+        assembler->WordEqual(var_value.value(), assembler->TheHoleConstant()),
+        &allocate_entry_if_needed);
+    var_value.Bind(assembler->UndefinedConstant());
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&double_values);
+  {
+    assembler->GotoIf(assembler->WordNotEqual(var_orig_map.value(), array_map),
+                      &generic_values);
+
+    Label is_smi(assembler), is_heapnum(assembler), do_load(assembler);
+    Variable var_idx(assembler, MachineRepresentation::kWord32);
+
+    assembler->Branch(assembler->TaggedIsSmi(index), &is_smi, &is_heapnum);
+
+    assembler->Bind(&is_smi);
+    {
+      var_idx.Bind(assembler->SmiToWord32(index));
+      assembler->Goto(&do_load);
+    }
+
+    assembler->Bind(&is_heapnum);
+    {
+      var_idx.Bind(assembler->TruncateFloat64ToWord32(
+          assembler->LoadHeapNumberValue(index)));
+      assembler->Goto(&do_load);
+    }
+
+    assembler->Bind(&do_load);
+    var_value.Bind(assembler->UndefinedConstant());
+    Node* value = assembler->LoadFixedDoubleArrayElement(
+        var_elements.value(), var_idx.value(), MachineType::Float64(), 0,
+        CodeStubAssembler::INTEGER_PARAMETERS, &allocate_entry_if_needed);
+    var_value.Bind(assembler->AllocateHeapNumberWithValue(value));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&generic_values);
+  {
+    Callable callable = CodeFactory::GetProperty(assembler->isolate());
+    var_value.Bind(assembler->CallStub(callable, context, array, index));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&uint8_values);
+  {
+    Node* value_uint8 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, UINT8_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->SmiFromWord(value_uint8));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&int8_values);
+  {
+    Node* value_int8 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, INT8_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->SmiFromWord(value_int8));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&uint16_values);
+  {
+    Node* value_uint16 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, UINT16_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->SmiFromWord(value_uint16));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&int16_values);
+  {
+    Node* value_int16 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, INT16_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->SmiFromWord(value_int16));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&uint32_values);
+  {
+    Node* value_uint32 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, UINT32_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->ChangeUint32ToTagged(value_uint32));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+  assembler->Bind(&int32_values);
+  {
+    Node* value_int32 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, INT32_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->ChangeInt32ToTagged(value_int32));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+  assembler->Bind(&float32_values);
+  {
+    Node* value_float32 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, FLOAT32_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->AllocateHeapNumberWithValue(
+        assembler->ChangeFloat32ToFloat64(value_float32)));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+  assembler->Bind(&float64_values);
+  {
+    Node* value_float64 = assembler->LoadFixedTypedArrayElement(
+        var_typed_elements.value(), index, FLOAT64_ELEMENTS,
+        CodeStubAssembler::SMI_PARAMETERS);
+    var_value.Bind(assembler->AllocateHeapNumberWithValue(value_float64));
+    assembler->Goto(&allocate_entry_if_needed);
+  }
+
+  assembler->Bind(&set_done_and_return);
+  {
+    assembler->StoreObjectFieldNoWriteBarrier(
+        iterator, JSTypedArrayIterator::kIteratedObjectOffset,
+        assembler->UndefinedConstant());
+    assembler->Goto(&did_set_done);
+    assembler->Bind(&did_set_done);
+    {
+      var_value.Bind(assembler->UndefinedConstant());
+      var_done.Bind(assembler->TrueConstant());
+      assembler->Goto(&allocate_iterator_result);
+    }
+  }
+
+  assembler->Bind(&allocate_entry_if_needed);
+  {
+    assembler->GotoIf(
+        assembler->Int32GreaterThan(
+            instance_type,
+            assembler->Int32Constant(LAST_ARRAY_KEY_VALUE_ITERATOR_TYPE)),
+        &allocate_iterator_result);
+    Node* elements = assembler->AllocateFixedArray(FAST_ELEMENTS,
+                                                   assembler->Int32Constant(2));
+    assembler->StoreFixedArrayElement(elements, assembler->Int32Constant(0),
+                                      index, SKIP_WRITE_BARRIER);
+    assembler->StoreFixedArrayElement(elements, assembler->Int32Constant(1),
+                                      var_value.value(), SKIP_WRITE_BARRIER);
+
+    Node* entry = assembler->Allocate(JSArray::kSize);
+    Node* map = assembler->LoadFixedArrayElement(
+        assembler->LoadNativeContext(context),
+        assembler->IntPtrConstant(Context::JS_ARRAY_FAST_ELEMENTS_MAP_INDEX), 0,
+        CodeStubAssembler::INTPTR_PARAMETERS);
+
+    assembler->StoreMapNoWriteBarrier(entry, map);
+    assembler->StoreObjectFieldRoot(entry, JSArray::kPropertiesOffset,
+                                    Heap::kEmptyFixedArrayRootIndex);
+    assembler->StoreObjectFieldNoWriteBarrier(entry, JSArray::kElementsOffset,
+                                              elements);
+    assembler->StoreObjectFieldNoWriteBarrier(
+        entry, JSArray::kLengthOffset, assembler->SmiConstant(Smi::FromInt(2)));
+
+    var_value.Bind(entry);
+    assembler->Goto(&allocate_iterator_result);
+  }
+
+  assembler->Bind(&allocate_iterator_result);
+  {
+    Node* result = assembler->Allocate(JSIteratorResult::kSize);
+    Node* map = assembler->LoadFixedArrayElement(
+        assembler->LoadNativeContext(context),
+        assembler->IntPtrConstant(Context::ITERATOR_RESULT_MAP_INDEX), 0,
+        CodeStubAssembler::INTPTR_PARAMETERS);
+    assembler->StoreMapNoWriteBarrier(result, map);
+    assembler->StoreObjectFieldRoot(result, JSIteratorResult::kPropertiesOffset,
+                                    Heap::kEmptyFixedArrayRootIndex);
+    assembler->StoreObjectFieldRoot(result, JSIteratorResult::kElementsOffset,
+                                    Heap::kEmptyFixedArrayRootIndex);
+    assembler->StoreObjectFieldNoWriteBarrier(
+        result, JSIteratorResult::kValueOffset, var_value.value());
+    assembler->StoreObjectFieldNoWriteBarrier(
+        result, JSIteratorResult::kDoneOffset, var_done.value());
+    assembler->Return(result);
+  }
+
+  assembler->Bind(&throw_bad_receiver);
+  {
+    // The {receiver} is not a valid JSArrayIterator or JSTypedArrayIterator.
+    Node* result = assembler->CallRuntime(
+        Runtime::kThrowIncompatibleMethodReceiver, context,
+        assembler->HeapConstant(assembler->factory()->NewStringFromAsciiChecked(
+            "Array Iterator.prototype.next", TENURED)),
+        iterator);
+    assembler->Return(result);
+  }
+}
+
 }  // namespace internal
 }  // namespace v8