Fastpath some spread-call desugaring.

src/builtins/builtins-spread.cc

Index: src/builtins/builtins-spread.cc
diff --git a/src/builtins/builtins-spread.cc b/src/builtins/builtins-spread.cc
new file mode 100644
index 0000000000000000000000000000000000000000..87a55ba1a40960d2a2d856299632242bc71f6f0a
--- /dev/null
+++ b/src/builtins/builtins-spread.cc
@@ -0,0 +1,49 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/builtins-utils.h"
+#include "src/builtins/builtins.h"
+
+namespace v8 {
+namespace internal {
+
+BUILTIN(SpreadIterablePrepare) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(2, args.length());
+  Handle<Object> spread = args.at<Object>(1);
+
+  if (spread->IsJSArray()) {
+    // Check that the spread arg has fast elements
+    Handle<JSArray> spread_array = Handle<JSArray>::cast(spread);
+    ElementsKind array_kind = spread_array->GetElementsKind();
+
+    if (IsFastElementsKind(array_kind)) {
+      // Check that the iterator hasn't been touched
+      Handle<Object> iterator_func;
+      Handle<Name> it_name = isolate->factory()->iterator_symbol();
+
+      if (Object::GetProperty(spread, it_name).ToHandle(&iterator_func)) {

[Yang, 2016/11/08 14:08:41]

Does this violate the spec? GetProperty may be observable (through Javascript
accessors for example). So if we figure out that the iterator is not the
original one, we load it once here, and later in spread_iterable_function, we
load it again in the for-of.

We could use GetDataProperty here, but I think we might be able to use the
array_protector cell here (see builtins/builtins-array.cc and look for
array_protector)

And please add test cases for this kind of thing.

[petermarshall, 2016/11/10 12:19:20]

Yeah it does violate the spec. I added a test case for this and for a few other
things that could potentially go wrong. The array_protector doesn't currently
help us here, but I added a protector cell for the array iterator.

+        JSObject* default_iterator =
+            isolate->native_context()->initial_array_iterator();
+
+        if (*iterator_func == default_iterator) {
+          return *spread;
+        }
+      }
+    }
+  }
+
+  Handle<JSFunction> spread_iterable_function = isolate->spread_iterable();
+
+  Handle<Object> spreaded;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, spreaded,
+      Execution::Call(isolate, spread_iterable_function,
+                      isolate->factory()->undefined_value(), 1, &spread));
+
+  return *spreaded;
+}
+
+}  // namespace internal
+}  // namespace v8