[builtins] implement Array.prototype[@@iterator] in TFJ builtins

src/builtins/builtins-array.cc

Index: src/builtins/builtins-array.cc
diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
index b5190e66bc9d1b1d9dc37e6b3bece61ccf5be399..b8d58b93ce502f9084738cdbba92c5b3068c7907 100644
--- a/src/builtins/builtins-array.cc
+++ b/src/builtins/builtins-array.cc
@@ -6,6 +6,7 @@
 #include "src/builtins/builtins-utils.h"
 
 #include "src/code-factory.h"
+#include "src/contexts.h"
 #include "src/elements.h"
 
 namespace v8 {
@@ -2067,5 +2068,504 @@ void Builtins::Generate_ArrayIndexOf(CodeStubAssembler* assembler) {
                                            array, search_element, start_from));
 }
 
+namespace {
+
+template <IterationKind kIterationKind>
+void Generate_ArrayPrototypeIterationMethod(CodeStubAssembler* assembler) {
+  typedef compiler::Node Node;
+  typedef CodeStubAssembler::Label Label;
+  typedef CodeStubAssembler::Variable Variable;
+
+  Node* receiver = assembler->Parameter(0);
+  Node* context = assembler->Parameter(3);
+
+  Variable var_array(assembler, MachineRepresentation::kTagged);
+  Variable var_map(assembler, MachineRepresentation::kTagged);
+  Variable var_type(assembler, MachineRepresentation::kWord32);
+
+  Label if_isnotobject(assembler, Label::kDeferred);
+  Label create_array_iterator(assembler);
+
+  assembler->GotoIf(assembler->TaggedIsSmi(receiver), &if_isnotobject);
+  var_array.Bind(receiver);
+  var_map.Bind(assembler->LoadMap(receiver));
+  var_type.Bind(assembler->LoadMapInstanceType(var_map.value()));
+  assembler->Branch(
+      assembler->Int32LessThan(
+          var_type.value(), assembler->Int32Constant(FIRST_JS_RECEIVER_TYPE)),
+      &if_isnotobject, &create_array_iterator);
+
+  assembler->Bind(&if_isnotobject);
+  {
+    Callable callable = CodeFactory::ToObject(assembler->isolate());
+    Node* result = assembler->CallStub(callable, context, receiver);
+    var_array.Bind(result);
+    var_map.Bind(assembler->LoadMap(result));
+    var_type.Bind(assembler->LoadMapInstanceType(var_map.value()));
+    assembler->Goto(&create_array_iterator);
+  }
+
+  assembler->Bind(&create_array_iterator);
+  assembler->Return(assembler->CreateArrayIterator(
+      var_array.value(), var_map.value(), var_type.value(), context,
+      kIterationKind));
+}
+}  // namespace
+
+void Builtins::Generate_ArrayPrototypeValues(CodeStubAssembler* assembler) {
+  Generate_ArrayPrototypeIterationMethod<IterationKind::kValues>(assembler);
+}
+
+void Builtins::Generate_ArrayPrototypeEntries(CodeStubAssembler* assembler) {
+  Generate_ArrayPrototypeIterationMethod<IterationKind::kEntries>(assembler);
+}
+
+void Builtins::Generate_ArrayPrototypeKeys(CodeStubAssembler* assembler) {
+  Generate_ArrayPrototypeIterationMethod<IterationKind::kKeys>(assembler);
+}
+
+void Builtins::Generate_ArrayIteratorPrototypeNext(
+    CodeStubAssembler* assembler) {
+  typedef compiler::Node Node;
+  typedef CodeStubAssembler::Label Label;
+  typedef CodeStubAssembler::Variable Variable;
+
+  Node* iterator = assembler->Parameter(0);
+  Node* context = assembler->Parameter(3);
+
+  Variable var_value(assembler, MachineRepresentation::kTagged);
+  Variable var_done(assembler, MachineRepresentation::kTagged);
+
+  // Required, or else `throw_bad_receiver` fails a DCHECK due to thse variables
+  // not being bound along all paths, despite not being used.
+  var_done.Bind(assembler->TrueConstant());
+  var_value.Bind(assembler->UndefinedConstant());
+
+  Label throw_bad_receiver(assembler, Label::kDeferred);
+  Label set_done(assembler), did_set_done(assembler);
+  Label allocate_key_result(assembler);
+  Label allocate_entry_if_needed(assembler);
+  Label allocate_iterator_result(assembler);
+  Label invalidate_array_iterator_protector(assembler);
+
+  // If O does not have all of the internal slots of an Array Iterator Instance
+  // (22.1.5.3), throw a TypeError exception
+  assembler->GotoIf(assembler->TaggedIsSmi(iterator), &throw_bad_receiver);
+  Node* instance_type = assembler->LoadInstanceType(iterator);
+  assembler->GotoIf(
+      assembler->Uint32LessThan(
+          assembler->Int32Constant(LAST_ARRAY_ITERATOR_TYPE -
+                                   FIRST_ARRAY_ITERATOR_TYPE),
+          assembler->Int32Sub(instance_type, assembler->Int32Constant(
+                                                 FIRST_ARRAY_ITERATOR_TYPE))),
+      &throw_bad_receiver);
+
+  // Let a be O.[[IteratedObject]].
+  Node* array = assembler->LoadObjectField(
+      iterator, JSArrayIterator::kIteratedObjectOffset);
+
+  // If a is undefined, return CreateIterResultObject(undefined, true)
+  assembler->GotoIf(assembler->WordEqual(array, assembler->UndefinedConstant()),

[Benedikt Meurer, 2016/10/15 17:45:25]

You can move this check to the if_isnotfastarray case. That removes another
check from the fast array common case. Undefined will always fail the JSArray
map check.

+                    &did_set_done);
+
+  // Let index be O.[[ArrayIteratorNextIndex]].
+  Node* index =
+      assembler->LoadObjectField(iterator, JSArrayIterator::kNextIndexOffset);
+  Node* orig_map = assembler->LoadObjectField(
+      iterator, JSArrayIterator::kIteratedObjectMapOffset);
+  Node* array_map = assembler->LoadMap(array);
+
+  Label if_isfastarray(assembler), if_isnotfastarray(assembler);
+
+  assembler->Branch(assembler->WordEqual(orig_map, array_map), &if_isfastarray,
+                    &if_isnotfastarray);
+
+  assembler->Bind(&if_isfastarray);
+  {
+    assembler->Assert(
+        assembler->Word32Equal(assembler->LoadMapInstanceType(array_map),
+                               assembler->Int32Constant(JS_ARRAY_TYPE)));
+
+    Node* length = assembler->LoadObjectField(array, JSArray::kLengthOffset);
+
+    assembler->Assert(assembler->TaggedIsSmi(length));
+    assembler->Assert(assembler->TaggedIsSmi(index));
+
+    assembler->GotoIf(assembler->SmiBelow(index, length), &set_done);

[Benedikt Meurer, 2016/10/15 18:07:01]

s/GotoIf/GotoUnless

+
+    Node* one = assembler->SmiConstant(Smi::FromInt(1));
+    assembler->StoreObjectFieldNoWriteBarrier(
+        iterator, JSArrayIterator::kNextIndexOffset,
+        assembler->IntPtrAdd(assembler->BitcastTaggedToWord(index),
+                             assembler->BitcastTaggedToWord(one)));
+
+    var_done.Bind(assembler->FalseConstant());
+    Node* elements = assembler->LoadElements(array);
+
+    static int32_t kInstanceType[] = {
+        JS_GENERIC_ARRAY_KEY_ITERATOR_TYPE,
+        JS_FAST_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+        JS_FAST_HOLEY_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+        JS_FAST_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+        JS_FAST_HOLEY_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+        JS_FAST_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+        JS_FAST_HOLEY_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+        JS_FAST_SMI_ARRAY_VALUE_ITERATOR_TYPE,
+        JS_FAST_HOLEY_SMI_ARRAY_VALUE_ITERATOR_TYPE,
+        JS_FAST_ARRAY_VALUE_ITERATOR_TYPE,
+        JS_FAST_HOLEY_ARRAY_VALUE_ITERATOR_TYPE,
+        JS_FAST_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE,
+        JS_FAST_HOLEY_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE,
+    };
+
+    Label packed_object_values(assembler), holey_object_values(assembler),
+        packed_double_values(assembler), holey_double_values(assembler);
+    Label* kInstanceTypeHandlers[] = {
+        &allocate_key_result,  &packed_object_values, &holey_object_values,
+        &packed_object_values, &holey_object_values,  &packed_double_values,
+        &holey_double_values,  &packed_object_values, &holey_object_values,
+        &packed_object_values, &holey_object_values,  &packed_double_values,
+        &holey_double_values};
+
+    assembler->Switch(instance_type, &throw_bad_receiver, kInstanceType,
+                      kInstanceTypeHandlers, arraysize(kInstanceType));
+
+    assembler->Bind(&packed_object_values);
+    {
+      var_value.Bind(assembler->LoadFixedArrayElement(
+          elements, index, 0, CodeStubAssembler::SMI_PARAMETERS));
+      assembler->Goto(&allocate_entry_if_needed);
+    }
+
+    assembler->Bind(&packed_double_values);
+    {
+      Node* value = assembler->LoadFixedDoubleArrayElement(
+          elements, index, MachineType::Float64(), 0,
+          CodeStubAssembler::SMI_PARAMETERS);
+      var_value.Bind(assembler->AllocateHeapNumberWithValue(value));
+      assembler->Goto(&allocate_entry_if_needed);
+    }
+
+    assembler->Bind(&holey_object_values);
+    {
+      // Check the array_protector cell, and take the slow path if it's invalid.
+      Node* invalid =
+          assembler->SmiConstant(Smi::FromInt(Isolate::kArrayProtectorInvalid));
+      Node* cell = assembler->LoadRoot(Heap::kArrayProtectorRootIndex);
+      Node* cell_value =
+          assembler->LoadObjectField(cell, PropertyCell::kValueOffset);
+      assembler->GotoIf(assembler->WordEqual(cell_value, invalid),
+                        &invalidate_array_iterator_protector);
+
+      var_value.Bind(assembler->UndefinedConstant());
+      Node* value = assembler->LoadFixedArrayElement(
+          elements, index, 0, CodeStubAssembler::SMI_PARAMETERS);
+      assembler->GotoIf(
+          assembler->WordEqual(value, assembler->TheHoleConstant()),
+          &allocate_entry_if_needed);
+      var_value.Bind(value);
+      assembler->Goto(&allocate_entry_if_needed);
+    }
+
+    assembler->Bind(&holey_double_values);
+    {
+      // Check the array_protector cell, and take the slow path if it's invalid.
+      Node* invalid =
+          assembler->SmiConstant(Smi::FromInt(Isolate::kArrayProtectorInvalid));
+      Node* cell = assembler->LoadRoot(Heap::kArrayProtectorRootIndex);
+      Node* cell_value =
+          assembler->LoadObjectField(cell, PropertyCell::kValueOffset);
+      assembler->GotoIf(assembler->WordEqual(cell_value, invalid),
+                        &invalidate_array_iterator_protector);
+
+      var_value.Bind(assembler->UndefinedConstant());
+      Node* value = assembler->LoadFixedDoubleArrayElement(
+          elements, index, MachineType::Float64(), 0,
+          CodeStubAssembler::SMI_PARAMETERS, &allocate_entry_if_needed);
+      var_value.Bind(assembler->AllocateHeapNumberWithValue(value));
+      assembler->Goto(&allocate_entry_if_needed);
+    }
+  }
+
+  assembler->Bind(&if_isnotfastarray);
+  {
+    Label if_istypedarray(assembler), if_isgeneric(assembler);

[Benedikt Meurer, 2016/10/15 17:45:25]

Mark the if_isgeneric with kDeferred.

+
+    assembler->Branch(
+        assembler->Word32Equal(assembler->LoadInstanceType(array),
+                               assembler->Int32Constant(JS_TYPED_ARRAY_TYPE)),
+        &if_istypedarray, &if_isgeneric);
+
+    assembler->Bind(&if_isgeneric);
+    {
+      Node* length_string = assembler->HeapConstant(
+          assembler->isolate()->factory()->length_string());
+      Callable get_property = CodeFactory::GetProperty(assembler->isolate());
+      Node* length =
+          assembler->CallStub(get_property, context, array, length_string);
+      Callable to_length = CodeFactory::ToLength(assembler->isolate());
+      length = assembler->CallStub(to_length, context, length);
+
+      Callable less_than = CodeFactory::LessThan(assembler->isolate());

[Benedikt Meurer, 2016/10/15 17:49:19]

Ah, this is the issue: You use LessThan, which is generated (in the builtins)
after this builtin. So the builtin table still contains Smi zero when you use it
here. In this case you know that both length and index are either HeapNumber or
Smi, so you can just convert both to Float64 and do a direct Float64LessThan
comparison, that should be (a) more efficient and will (b) fix your bug.

+      Node* is_less = assembler->CallStub(less_than, context, index, length);
+      assembler->GotoIf(
+          assembler->WordEqual(is_less, assembler->TrueConstant()), &set_done);
+
+      assembler->StoreObjectFieldNoWriteBarrier(
+          iterator, JSArrayIterator::kNextIndexOffset,
+          assembler->NumberInc(index));
+      var_done.Bind(assembler->FalseConstant());
+
+      Label generic_values(assembler);
+      assembler->Branch(
+          assembler->Word32Equal(
+              instance_type,
+              assembler->Int32Constant(JS_GENERIC_ARRAY_KEY_ITERATOR_TYPE)),
+          &allocate_key_result, &generic_values);
+
+      assembler->Bind(&invalidate_array_iterator_protector);

[Benedikt Meurer, 2016/10/15 17:45:26]

This is only required for the TurboFan inline version; let's add this later in
the CL for the TurboFan inlining.

+      {
+        Node* invalid = assembler->SmiConstant(
+            Smi::FromInt(Isolate::kArrayProtectorInvalid));
+        Node* cell =
+            assembler->LoadRoot(Heap::kArrayIteratorProtectorRootIndex);
+
+        Node* cell_value =
+            assembler->LoadObjectField(cell, PropertyCell::kValueOffset);
+        assembler->GotoIf(assembler->IntPtrEqual(cell_value, invalid),
+                          &generic_values);
+
+        // If code dependencies change, call Runtime to update the field and
+        // deopt dependent code
+        assembler->CallRuntime(Runtime::kInvalidateArrayIteratorProtector,
+                               context);
+        assembler->Goto(&generic_values);
+      }
+
+      assembler->Bind(&generic_values);
+      {
+        var_value.Bind(
+            assembler->CallStub(get_property, context, array, index));
+        assembler->Goto(&allocate_entry_if_needed);
+      }
+    }
+
+    assembler->Bind(&if_istypedarray);
+    {
+      Node* length =
+          assembler->LoadObjectField(array, JSTypedArray::kLengthOffset);
+
+      assembler->Assert(assembler->TaggedIsSmi(length));
+      assembler->Assert(assembler->TaggedIsSmi(index));
+
+      assembler->GotoUnless(assembler->SmiBelow(index, length), &set_done);
+
+      Node* one = assembler->SmiConstant(Smi::FromInt(1));
+      assembler->StoreObjectFieldNoWriteBarrier(
+          iterator, JSArrayIterator::kNextIndexOffset,
+          assembler->IntPtrAdd(assembler->BitcastTaggedToWord(index),
+                               assembler->BitcastTaggedToWord(one)));
+      var_done.Bind(assembler->FalseConstant());
+
+      Node* elements = assembler->LoadElements(array);
+      Node* base_ptr = assembler->LoadObjectField(
+          elements, FixedTypedArrayBase::kBasePointerOffset);
+      Node* external_ptr = assembler->LoadObjectField(
+          elements, FixedTypedArrayBase::kExternalPointerOffset);
+      Node* data_ptr = assembler->IntPtrAdd(base_ptr, external_ptr);
+
+      static int32_t kInstanceType[] = {
+          JS_TYPED_ARRAY_KEY_ITERATOR_TYPE,
+          JS_UINT8_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+          JS_UINT8_CLAMPED_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+          JS_INT8_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+          JS_UINT16_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+          JS_INT16_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+          JS_UINT32_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+          JS_INT32_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+          JS_FLOAT32_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+          JS_FLOAT64_ARRAY_KEY_VALUE_ITERATOR_TYPE,
+          JS_UINT8_ARRAY_VALUE_ITERATOR_TYPE,
+          JS_UINT8_CLAMPED_ARRAY_VALUE_ITERATOR_TYPE,
+          JS_INT8_ARRAY_VALUE_ITERATOR_TYPE,
+          JS_UINT16_ARRAY_VALUE_ITERATOR_TYPE,
+          JS_INT16_ARRAY_VALUE_ITERATOR_TYPE,
+          JS_UINT32_ARRAY_VALUE_ITERATOR_TYPE,
+          JS_INT32_ARRAY_VALUE_ITERATOR_TYPE,
+          JS_FLOAT32_ARRAY_VALUE_ITERATOR_TYPE,
+          JS_FLOAT64_ARRAY_VALUE_ITERATOR_TYPE,
+      };
+
+      Label uint8_values(assembler), int8_values(assembler),
+          uint16_values(assembler), int16_values(assembler),
+          uint32_values(assembler), int32_values(assembler),
+          float32_values(assembler), float64_values(assembler);
+      Label* kInstanceTypeHandlers[] = {
+          &allocate_key_result, &uint8_values,  &uint8_values,
+          &int8_values,         &uint16_values, &int16_values,
+          &uint32_values,       &int32_values,  &float32_values,
+          &float64_values,      &uint8_values,  &uint8_values,
+          &int8_values,         &uint16_values, &int16_values,
+          &uint32_values,       &int32_values,  &float32_values,
+          &float64_values,
+      };
+
+      var_done.Bind(assembler->FalseConstant());
+      assembler->Switch(instance_type, &throw_bad_receiver, kInstanceType,
+                        kInstanceTypeHandlers, arraysize(kInstanceType));
+
+      assembler->Bind(&uint8_values);
+      {
+        Node* value_uint8 = assembler->LoadFixedTypedArrayElement(
+            data_ptr, index, UINT8_ELEMENTS, CodeStubAssembler::SMI_PARAMETERS);
+        var_value.Bind(assembler->SmiFromWord(value_uint8));
+        assembler->Goto(&allocate_entry_if_needed);
+      }
+
+      assembler->Bind(&int8_values);
+      {
+        Node* value_int8 = assembler->LoadFixedTypedArrayElement(
+            data_ptr, index, INT8_ELEMENTS, CodeStubAssembler::SMI_PARAMETERS);
+        var_value.Bind(assembler->SmiFromWord(value_int8));
+        assembler->Goto(&allocate_entry_if_needed);
+      }
+
+      assembler->Bind(&uint16_values);
+      {
+        Node* value_uint16 = assembler->LoadFixedTypedArrayElement(
+            data_ptr, index, UINT16_ELEMENTS,
+            CodeStubAssembler::SMI_PARAMETERS);
+        var_value.Bind(assembler->SmiFromWord(value_uint16));
+        assembler->Goto(&allocate_entry_if_needed);
+      }
+
+      assembler->Bind(&int16_values);
+      {
+        Node* value_int16 = assembler->LoadFixedTypedArrayElement(
+            data_ptr, index, INT16_ELEMENTS, CodeStubAssembler::SMI_PARAMETERS);
+        var_value.Bind(assembler->SmiFromWord(value_int16));
+        assembler->Goto(&allocate_entry_if_needed);
+      }
+
+      assembler->Bind(&uint32_values);
+      {
+        Node* value_uint32 = assembler->LoadFixedTypedArrayElement(
+            data_ptr, index, UINT32_ELEMENTS,
+            CodeStubAssembler::SMI_PARAMETERS);
+        var_value.Bind(assembler->ChangeUint32ToTagged(value_uint32));
+        assembler->Goto(&allocate_entry_if_needed);
+      }
+      assembler->Bind(&int32_values);
+      {
+        Node* value_int32 = assembler->LoadFixedTypedArrayElement(
+            data_ptr, index, INT32_ELEMENTS, CodeStubAssembler::SMI_PARAMETERS);
+        var_value.Bind(assembler->ChangeInt32ToTagged(value_int32));
+        assembler->Goto(&allocate_entry_if_needed);
+      }
+      assembler->Bind(&float32_values);
+      {
+        Node* value_float32 = assembler->LoadFixedTypedArrayElement(
+            data_ptr, index, FLOAT32_ELEMENTS,
+            CodeStubAssembler::SMI_PARAMETERS);
+        var_value.Bind(assembler->AllocateHeapNumberWithValue(
+            assembler->ChangeFloat32ToFloat64(value_float32)));
+        assembler->Goto(&allocate_entry_if_needed);
+      }
+      assembler->Bind(&float64_values);
+      {
+        Node* value_float64 = assembler->LoadFixedTypedArrayElement(
+            data_ptr, index, FLOAT64_ELEMENTS,
+            CodeStubAssembler::SMI_PARAMETERS);
+        var_value.Bind(assembler->AllocateHeapNumberWithValue(value_float64));
+        assembler->Goto(&allocate_entry_if_needed);
+      }
+    }
+  }
+
+  assembler->Bind(&set_done);
+  {
+    assembler->StoreObjectFieldNoWriteBarrier(
+        iterator, JSArrayIterator::kIteratedObjectOffset,
+        assembler->UndefinedConstant());
+    assembler->Goto(&did_set_done);
+  }
+  assembler->Bind(&did_set_done);
+  {
+    var_value.Bind(assembler->UndefinedConstant());
+    var_done.Bind(assembler->TrueConstant());
+    assembler->Goto(&allocate_iterator_result);
+  }
+
+  assembler->Bind(&allocate_key_result);
+  {
+    var_value.Bind(index);
+    var_done.Bind(assembler->FalseConstant());
+    assembler->Goto(&allocate_iterator_result);
+  }
+
+  assembler->Bind(&allocate_entry_if_needed);
+  {
+    assembler->GotoIf(
+        assembler->Int32GreaterThan(
+            instance_type,
+            assembler->Int32Constant(LAST_ARRAY_KEY_VALUE_ITERATOR_TYPE)),
+        &allocate_iterator_result);
+
+    Node* elements = assembler->AllocateFixedArray(FAST_ELEMENTS,
+                                                   assembler->Int32Constant(2));
+    assembler->StoreFixedArrayElement(elements, assembler->Int32Constant(0),
+                                      index, SKIP_WRITE_BARRIER);
+    assembler->StoreFixedArrayElement(elements, assembler->Int32Constant(1),
+                                      var_value.value(), SKIP_WRITE_BARRIER);
+
+    Node* entry = assembler->Allocate(JSArray::kSize);
+    Node* map = assembler->LoadFixedArrayElement(
+        assembler->LoadNativeContext(context),
+        assembler->IntPtrConstant(Context::JS_ARRAY_FAST_ELEMENTS_MAP_INDEX), 0,
+        CodeStubAssembler::INTPTR_PARAMETERS);
+
+    assembler->StoreMapNoWriteBarrier(entry, map);
+    assembler->StoreObjectFieldRoot(entry, JSArray::kPropertiesOffset,
+                                    Heap::kEmptyFixedArrayRootIndex);
+    assembler->StoreObjectFieldNoWriteBarrier(entry, JSArray::kElementsOffset,
+                                              elements);
+    assembler->StoreObjectFieldNoWriteBarrier(
+        entry, JSArray::kLengthOffset, assembler->SmiConstant(Smi::FromInt(2)));
+
+    var_value.Bind(entry);
+    assembler->Goto(&allocate_iterator_result);
+  }
+
+  assembler->Bind(&allocate_iterator_result);
+  {
+    Node* result = assembler->Allocate(JSIteratorResult::kSize);
+    Node* map = assembler->LoadFixedArrayElement(
+        assembler->LoadNativeContext(context),
+        assembler->IntPtrConstant(Context::ITERATOR_RESULT_MAP_INDEX), 0,
+        CodeStubAssembler::INTPTR_PARAMETERS);
+    assembler->StoreMapNoWriteBarrier(result, map);
+    assembler->StoreObjectFieldRoot(result, JSIteratorResult::kPropertiesOffset,
+                                    Heap::kEmptyFixedArrayRootIndex);
+    assembler->StoreObjectFieldRoot(result, JSIteratorResult::kElementsOffset,
+                                    Heap::kEmptyFixedArrayRootIndex);
+    assembler->StoreObjectFieldNoWriteBarrier(
+        result, JSIteratorResult::kValueOffset, var_value.value());
+    assembler->StoreObjectFieldNoWriteBarrier(
+        result, JSIteratorResult::kDoneOffset, var_done.value());
+    assembler->Return(result);
+  }
+
+  assembler->Bind(&throw_bad_receiver);
+  {
+    // The {receiver} is not a valid JSArrayIterator.
+    Node* result = assembler->CallRuntime(
+        Runtime::kThrowIncompatibleMethodReceiver, context,
+        assembler->HeapConstant(assembler->factory()->NewStringFromAsciiChecked(
+            "Array Iterator.prototype.next", TENURED)),
+        iterator);
+    assembler->Return(result);
+  }
+}
+
 }  // namespace internal
 }  // namespace v8