[runtime] Object.create(null) creates a slow object

src/code-stub-assembler.h

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_CODE_STUB_ASSEMBLER_H_
 #define V8_CODE_STUB_ASSEMBLER_H_
 
 #include <functional>
 
 #include "src/compiler/code-assembler.h"
@@ skipping 90 matching lines @@
 
   compiler::Node* HashSeed();
   compiler::Node* StaleRegisterConstant();
 
   compiler::Node* IntPtrOrSmiConstant(int value, ParameterMode mode);
 
   compiler::Node* IntPtrAddFoldConstants(compiler::Node* left,
                                          compiler::Node* right);
   compiler::Node* IntPtrSubFoldConstants(compiler::Node* left,
                                          compiler::Node* right);
+  compiler::Node* IntPtrRoundUpToPowerOfTwo32(compiler::Node* word32);
+  compiler::Node* IntPtrMax(compiler::Node* left, compiler::Node* right);
 
   // Float64 operations.
   compiler::Node* Float64Ceil(compiler::Node* x);
   compiler::Node* Float64Floor(compiler::Node* x);
   compiler::Node* Float64Round(compiler::Node* x);
   compiler::Node* Float64Trunc(compiler::Node* x);
 
   // Tag a Word as a Smi value.
   compiler::Node* SmiTag(compiler::Node* value);
   // Untag a Smi value as a Word.
@@ skipping 39 matching lines @@
 
   void Assert(compiler::Node* condition, const char* string = nullptr,
               const char* file = nullptr, int line = 0);
 
   // Check a value for smi-ness
   compiler::Node* TaggedIsSmi(compiler::Node* a);
   // Check that the value is a non-negative smi.
   compiler::Node* WordIsPositiveSmi(compiler::Node* a);
   // Check that a word has a word-aligned address.
   compiler::Node* WordIsWordAligned(compiler::Node* word);
+  compiler::Node* WordIsPowerOfTwo(compiler::Node* value);
 
   void BranchIfSmiEqual(compiler::Node* a, compiler::Node* b, Label* if_true,
                         Label* if_false) {
     Branch(SmiEqual(a, b), if_true, if_false);
   }
 
   void BranchIfSmiLessThan(compiler::Node* a, compiler::Node* b, Label* if_true,
                            Label* if_false) {
     Branch(SmiLessThan(a, b), if_true, if_false);
   }
@@ skipping 99 matching lines @@
   // Load the inobject properties count of a Map (valid only for JSObjects).
   compiler::Node* LoadMapInobjectProperties(compiler::Node* map);
   // Load the constructor function index of a Map (only for primitive maps).
   compiler::Node* LoadMapConstructorFunctionIndex(compiler::Node* map);
   // Load the constructor of a Map (equivalent to Map::GetConstructor()).
   compiler::Node* LoadMapConstructor(compiler::Node* map);
   // Check whether the map is for an object with special properties, such as a
   // JSProxy or an object with interceptors.
   compiler::Node* IsSpecialReceiverMap(compiler::Node* map);
   compiler::Node* IsSpecialReceiverInstanceType(compiler::Node* instance_type);
+  // Check if the map is set for slow properties.
+  compiler::Node* IsDictionaryMap(compiler::Node* map);
 
   // Load the hash field of a name as an uint32 value.
   compiler::Node* LoadNameHashField(compiler::Node* name);
   // Load the hash value of a name as an uint32 value.
   // If {if_hash_not_computed} label is specified then it also checks if
   // hash is actually computed.
   compiler::Node* LoadNameHash(compiler::Node* name,
                                Label* if_hash_not_computed = nullptr);
 
   // Load length field of a String object.
@@ skipping 54 matching lines @@
   compiler::Node* StoreObjectFieldNoWriteBarrier(
       compiler::Node* object, compiler::Node* offset, compiler::Node* value,
       MachineRepresentation rep = MachineRepresentation::kTagged);
   // Store the Map of an HeapObject.
   compiler::Node* StoreMapNoWriteBarrier(compiler::Node* object,
                                          compiler::Node* map);
   compiler::Node* StoreObjectFieldRoot(compiler::Node* object, int offset,
                                        Heap::RootListIndex root);
   // Store an array element to a FixedArray.
   compiler::Node* StoreFixedArrayElement(
+      compiler::Node* object, int index, compiler::Node* value,
+      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
+      ParameterMode parameter_mode = INTEGER_PARAMETERS) {
+    return StoreFixedArrayElement(object, Int32Constant(index), value,
+                                  barrier_mode, parameter_mode);
+  }
+
+  compiler::Node* StoreFixedArrayElement(
       compiler::Node* object, compiler::Node* index, compiler::Node* value,
       WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
       ParameterMode parameter_mode = INTEGER_PARAMETERS);
 
   compiler::Node* StoreFixedDoubleArrayElement(
       compiler::Node* object, compiler::Node* index, compiler::Node* value,
       ParameterMode parameter_mode = INTEGER_PARAMETERS);
 
   void StoreFieldsNoWriteBarrier(compiler::Node* start_address,
                                  compiler::Node* end_address,
@@ skipping 51 matching lines @@
 
   // Allocate a RegExpResult with the given length (the number of captures,
   // including the match itself), index (the index where the match starts),
   // and input string. |length| and |index| are expected to be tagged, and
   // |input| must be a string.
   compiler::Node* AllocateRegExpResult(compiler::Node* context,
                                        compiler::Node* length,
                                        compiler::Node* index,
                                        compiler::Node* input);
 
+  compiler::Node* AllocateNameDictionary(int capacity);
+  compiler::Node* AllocateNameDictionary(compiler::Node* capacity);
+
   compiler::Node* AllocateJSObjectFromMap(compiler::Node* map,
                                           compiler::Node* properties = nullptr,
                                           compiler::Node* elements = nullptr);
 
   void InitializeJSObjectFromMap(compiler::Node* object, compiler::Node* map,
                                  compiler::Node* size,
                                  compiler::Node* properties = nullptr,
                                  compiler::Node* elements = nullptr);
 
   void InitializeJSObjectBody(compiler::Node* object, compiler::Node* map,
@@ skipping 271 matching lines @@
                  Label* if_keyisunique, Label* if_bailout);
 
   // Calculates array index for given dictionary entry and entry field.
   // See Dictionary::EntryToIndex().
   template <typename Dictionary>
   compiler::Node* EntryToIndex(compiler::Node* entry, int field_index);
   template <typename Dictionary>
   compiler::Node* EntryToIndex(compiler::Node* entry) {
     return EntryToIndex<Dictionary>(entry, Dictionary::kEntryKeyIndex);
   }
+  // Calculate a valid size for the a hash table.
+  compiler::Node* HashTableComputeCapacity(compiler::Node* at_least_space_for);
 
   // Looks up an entry in a NameDictionaryBase successor. If the entry is found
   // control goes to {if_found} and {var_name_index} contains an index of the
   // key field of the entry found. If the key is not found control goes to
   // {if_not_found}.
   static const int kInlinedDictionaryProbes = 4;
   template <typename Dictionary>
   void NameDictionaryLookup(compiler::Node* dictionary,
                             compiler::Node* unique_name, Label* if_found,
                             Variable* var_name_index, Label* if_not_found,
@@ skipping 390 matching lines @@
   static const int kElementLoopUnrollThreshold = 8;
 };
 
 #define CSA_ASSERT(x) Assert((x), #x, __FILE__, __LINE__)
 
 DEFINE_OPERATORS_FOR_FLAGS(CodeStubAssembler::AllocationFlags);
 
 }  // namespace internal
 }  // namespace v8
 #endif  // V8_CODE_STUB_ASSEMBLER_H_