[builtins] Fix Object.create(null) special case

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 #include "src/ic/handler-configuration.h"
 #include "src/ic/stub-cache.h"
 
@@ skipping 1093 matching lines @@
     GotoUnless(is_map_type, &done);
     result.Bind(
         LoadObjectField(result.value(), Map::kConstructorOrBackPointerOffset));
     Goto(&loop);
   }
   Bind(&done);
   return result.value();
 }
 
 Node* CodeStubAssembler::IsSpecialReceiverMap(Node* map) {
+  Node* is_special = IsSpecialReceiverInstanceType(LoadMapInstanceType(map));
   Node* bit_field = LoadMapBitField(map);
-  Node* mask = Int32Constant(1 << Map::kHasNamedInterceptor |
-                             1 << Map::kIsAccessCheckNeeded);
-  Assert(Word32Equal(Word32And(bit_field, mask), Int32Constant(0)));
-  return IsSpecialReceiverInstanceType(LoadMapInstanceType(map));
+  uint32_t mask =
+      1 << Map::kHasNamedInterceptor | 1 << Map::kIsAccessCheckNeeded;
+  // Interceptors or access checks imply special receiver.
+  CSA_ASSERT(
+      Select(IsSetWord32(bit_field, mask), is_special, Int32Constant(1)));
+  return is_special;
 }
 
 Node* CodeStubAssembler::IsSpecialReceiverInstanceType(Node* instance_type) {
   STATIC_ASSERT(JS_GLOBAL_OBJECT_TYPE <= LAST_SPECIAL_RECEIVER_TYPE);
   return Int32LessThanOrEqual(instance_type,
                               Int32Constant(LAST_SPECIAL_RECEIVER_TYPE));
 }
 
 Node* CodeStubAssembler::IsDictionaryMap(Node* map) {
   Node* bit_field3 = LoadMapBitField3(map);
@@ skipping 5779 matching lines @@
           BranchIfSmiLessThan(rhs, lhs, if_true, if_false);
           break;
         case kGreaterThanOrEqual:
           BranchIfSmiLessThanOrEqual(rhs, lhs, if_true, if_false);
           break;
       }
     }
 
     Bind(&if_rhsisnotsmi);
     {
-      Assert(WordEqual(LoadMap(rhs), HeapNumberMapConstant()));
+      CSA_ASSERT(WordEqual(LoadMap(rhs), HeapNumberMapConstant()));
       // Convert the {lhs} and {rhs} to floating point values, and
       // perform a floating point comparison.
       var_fcmp_lhs.Bind(SmiToFloat64(lhs));
       var_fcmp_rhs.Bind(LoadHeapNumberValue(rhs));
       Goto(&do_fcmp);
     }
   }
 
   Bind(&if_lhsisnotsmi);
   {
-    Assert(WordEqual(LoadMap(lhs), HeapNumberMapConstant()));
+    CSA_ASSERT(WordEqual(LoadMap(lhs), HeapNumberMapConstant()));
 
     // Check if {rhs} is a Smi or a HeapObject.
     Label if_rhsissmi(this), if_rhsisnotsmi(this);
     Branch(TaggedIsSmi(rhs), &if_rhsissmi, &if_rhsisnotsmi);
 
     Bind(&if_rhsissmi);
     {
       // Convert the {lhs} and {rhs} to floating point values, and
       // perform a floating point comparison.
       var_fcmp_lhs.Bind(LoadHeapNumberValue(lhs));
       var_fcmp_rhs.Bind(SmiToFloat64(rhs));
       Goto(&do_fcmp);
     }
 
     Bind(&if_rhsisnotsmi);
     {
-      Assert(WordEqual(LoadMap(rhs), HeapNumberMapConstant()));
+      CSA_ASSERT(WordEqual(LoadMap(rhs), HeapNumberMapConstant()));
 
       // Convert the {lhs} and {rhs} to floating point values, and
       // perform a floating point comparison.
       var_fcmp_lhs.Bind(LoadHeapNumberValue(lhs));
       var_fcmp_rhs.Bind(LoadHeapNumberValue(rhs));
       Goto(&do_fcmp);
     }
   }
 
   Bind(&do_fcmp);
@@ skipping 1396 matching lines @@
     Bind(&if_overflow);
     {
       var_finc_value.Bind(SmiToFloat64(value));
       Goto(&do_finc);
     }
   }
 
   Bind(&if_isnotsmi);
   {
     // Check if the value is a HeapNumber.
-    Assert(IsHeapNumberMap(LoadMap(value)));
+    CSA_ASSERT(IsHeapNumberMap(LoadMap(value)));
 
     // Load the HeapNumber value.
     var_finc_value.Bind(LoadHeapNumberValue(value));
     Goto(&do_finc);
   }
 
   Bind(&do_finc);
   {
     Node* finc_value = var_finc_value.value();
     Node* one = Float64Constant(1.0);
@@ skipping 34 matching lines @@
 
   // Slow Array iterator map index: (kBaseIndex + kSlowIteratorOffset)
   const int kSlowIteratorOffset =
       Context::GENERIC_ARRAY_VALUE_ITERATOR_MAP_INDEX -
       Context::UINT8_ARRAY_VALUE_ITERATOR_MAP_INDEX;
   STATIC_ASSERT(kSlowIteratorOffset ==
                 (Context::GENERIC_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX -
                  Context::UINT8_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX));
 
   // Assert: Type(array) is Object
-  Assert(IsJSReceiverInstanceType(array_type));
+  CSA_ASSERT(IsJSReceiverInstanceType(array_type));
 
   Variable var_result(this, MachineRepresentation::kTagged);
   Variable var_map_index(this, MachineType::PointerRepresentation());
   Variable var_array_map(this, MachineRepresentation::kTagged);
 
   Label return_result(this);
   Label allocate_iterator(this);
 
   if (mode == IterationKind::kKeys) {
     // There are only two key iterator maps, branch depending on whether or not
@@ skipping 38 matching lines @@
     Bind(&if_isgeneric);
     {
       Label if_isfast(this), if_isslow(this);
       BranchIfFastJSArray(array, context, &if_isfast, &if_isslow);
 
       Bind(&if_isfast);
       {
         Node* map_index =
             IntPtrAdd(IntPtrConstant(kBaseMapIndex + kFastIteratorOffset),
                       LoadMapElementsKind(array_map));
-        Assert(IntPtrGreaterThanOrEqual(
+        CSA_ASSERT(IntPtrGreaterThanOrEqual(
             map_index, IntPtrConstant(kBaseMapIndex + kFastIteratorOffset)));
-        Assert(IntPtrLessThan(
+        CSA_ASSERT(IntPtrLessThan(
             map_index, IntPtrConstant(kBaseMapIndex + kSlowIteratorOffset)));
 
         var_map_index.Bind(map_index);
         var_array_map.Bind(array_map);
         Goto(&allocate_iterator);
       }
 
       Bind(&if_isslow);
       {
         Node* map_index = IntPtrAdd(IntPtrConstant(kBaseMapIndex),
                                     IntPtrConstant(kSlowIteratorOffset));
         var_map_index.Bind(map_index);
         var_array_map.Bind(UndefinedConstant());
         Goto(&allocate_iterator);
       }
     }
 
     Bind(&if_istypedarray);
     {
       Node* map_index =
           IntPtrAdd(IntPtrConstant(kBaseMapIndex - UINT8_ELEMENTS),
                     LoadMapElementsKind(array_map));
-      Assert(IntPtrLessThan(
+      CSA_ASSERT(IntPtrLessThan(
           map_index, IntPtrConstant(kBaseMapIndex + kFastIteratorOffset)));
-      Assert(
+      CSA_ASSERT(
           IntPtrGreaterThanOrEqual(map_index, IntPtrConstant(kBaseMapIndex)));
       var_map_index.Bind(map_index);
       var_array_map.Bind(UndefinedConstant());
       Goto(&allocate_iterator);
     }
   }
 
   Bind(&allocate_iterator);
   {
     Node* map =
@@ skipping 30 matching lines @@
   Node* buffer_bit_field = LoadObjectField(
       buffer, JSArrayBuffer::kBitFieldOffset, MachineType::Uint32());
   Node* was_neutered_mask = Int32Constant(JSArrayBuffer::WasNeutered::kMask);
 
   return Word32NotEqual(Word32And(buffer_bit_field, was_neutered_mask),
                         Int32Constant(0));
 }
 
 }  // namespace internal
 }  // namespace v8