Fastpath some spread-call desugaring.

src/lookup.cc

Index: src/lookup.cc
diff --git a/src/lookup.cc b/src/lookup.cc
index fa6d579122b618554de15db315a823262c5dfc52..82f615218238cca8437f9691fe79ab3057866e33 100644
--- a/src/lookup.cc
+++ b/src/lookup.cc
@@ -194,6 +194,18 @@ void LookupIterator::InternalUpdateProtector() {
   } else if (*name_ == heap()->has_instance_symbol()) {
     if (!isolate_->IsHasInstanceLookupChainIntact()) return;
     isolate_->InvalidateHasInstanceProtector();
+  } else if (*name_ == heap()->iterator_symbol()) {
+    if (!isolate_->IsArrayIteratorLookupChainIntact()) return;
+    if (holder_->IsJSArray()) {
+      isolate_->InvalidateArrayIteratorProtector();
+    }
+  } else if (*name_ == heap()->next_string()) {

[Benedikt Meurer, 2016/11/10 12:32:59]

As discussed offline, please check against the initial map of the
%ArrayIterator%.prototype instead.

+    if (!isolate_->IsArrayIteratorLookupChainIntact()) return;
+    // Also invalidate the array iterator protector cell when the iterator
+    // itself is changed.
+    if (*holder_ == *isolate_->initial_array_iterator_prototype()) {
+      isolate_->InvalidateArrayIteratorProtector();
+    }
   }
 }