Fastpath some spread-call desugaring.

src/lookup.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/lookup.h"
 
 #include "src/bootstrapper.h"
 #include "src/deoptimizer.h"
 #include "src/elements.h"
 #include "src/field-type.h"
@@ skipping 176 matching lines @@
       isolate_->CountUsage(
           v8::Isolate::UseCounterFeature::kArraySpeciesModified);
       isolate_->InvalidateArraySpeciesProtector();
     }
   } else if (*name_ == heap()->is_concat_spreadable_symbol()) {
     if (!isolate_->IsIsConcatSpreadableLookupChainIntact()) return;
     isolate_->InvalidateIsConcatSpreadableProtector();
   } else if (*name_ == heap()->has_instance_symbol()) {
     if (!isolate_->IsHasInstanceLookupChainIntact()) return;
     isolate_->InvalidateHasInstanceProtector();
+  } else if (*name_ == heap()->iterator_symbol()) {
+    if (!isolate_->IsArrayIteratorLookupChainIntact()) return;
+    if (holder_->IsJSArray()) {
+      isolate_->InvalidateArrayIteratorProtector();
+    }
+  } else if (*name_ == heap()->next_string()) {

[Benedikt Meurer, 2016/11/10 12:32:59]

As discussed offline, please check against the initial map of the
%ArrayIterator%.prototype instead.

+    if (!isolate_->IsArrayIteratorLookupChainIntact()) return;
+    // Also invalidate the array iterator protector cell when the iterator
+    // itself is changed.
+    if (*holder_ == *isolate_->initial_array_iterator_prototype()) {
+      isolate_->InvalidateArrayIteratorProtector();
+    }
   }
 }
 
 void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
   DCHECK(state_ == DATA || state_ == ACCESSOR);
   DCHECK(HolderIsReceiverOrHiddenPrototype());
 
   Handle<JSObject> holder = GetHolder<JSObject>();
 
   if (IsElement()) {
@@ skipping 630 matching lines @@
                                       : access_check_info->named_interceptor();
     if (interceptor) {
       return handle(InterceptorInfo::cast(interceptor), isolate_);
     }
   }
   return Handle<InterceptorInfo>();
 }
 
 }  // namespace internal
 }  // namespace v8