[builtins] implement JSBuiltinReducer for ArrayIteratorNext()

src/compiler/access-builder.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 
 #include "src/compiler/type-cache.h"
 #include "src/contexts.h"
 #include "src/frames.h"
 #include "src/handles-inl.h"
@@ skipping 531 matching lines @@
   FieldAccess access = {kTaggedBase,
                         JSGlobalObject::kNativeContextOffset,
                         Handle<Name>(),
                         Type::Internal(),
                         MachineType::TaggedPointer(),
                         kPointerWriteBarrier};
   return access;
 }
 
 // static
+FieldAccess AccessBuilder::ForJSArrayIteratorObject() {
+  FieldAccess access = {kTaggedBase,
+                        JSArrayIterator::kIteratedObjectOffset,
+                        Handle<Name>(),
+                        Type::ReceiverOrUndefined(),

[Benedikt Meurer, 2016/11/09 20:00:32]

Note for later changes/direction: I've been chatting about this with Camillo
offline today, and I think we might want to change this aspect of the spec in
the future (or violate the spec here), as the undefined clearing of the internal
object slot causes a lot of trouble, for example, the load/check elimination
cannot really eliminate the LoadField for the object in each iteration, because
it can also be undefined, and thus we cannot just eliminate the map check
(unless we also do some heavy tracking of information along the control chain).
Plus this part of the spec is only concerned about resource management, and
that's not the business of the language spec.

So nothing to change for now (esp. not for this CL), but some heads up for the
future.

[caitp, 2016/11/09 20:55:24]

Acknowledged.

+                        MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
+  return access;
+}
+
+// static
+FieldAccess AccessBuilder::ForJSArrayIteratorIndex(InstanceType instance_type,
+                                                   ElementsKind elements_kind) {
+  FieldAccess access = {kTaggedBase,
+                        JSArrayIterator::kNextIndexOffset,
+                        Handle<Name>(),
+                        TypeCache::Get().kPositiveSafeInteger,

[Benedikt Meurer, 2016/11/09 20:00:32]

s/kPositiveSafeInteger/kPositiveInteger/

[caitp, 2016/11/09 20:55:24]

Iteration stops if index >= ToLength(array.[[Get]]("length")), doesn't that cap
this to 2^53-1, since the index is never incremented in that situation?

Done for now, but we could I think it's valid to narrow the range of values a
bit

[Benedikt Meurer, 2016/11/10 04:49:55]

Good point, you are right, thanks for the explanation. So feel free to change it
back (and maybe add a comment why this is safe).

+                        MachineType::AnyTagged(),
+                        kFullWriteBarrier};
+  if (instance_type == JS_ARRAY_TYPE) {
+    if (IsFastDoubleElementsKind(elements_kind)) {
+      access.type = TypeCache::Get().kFixedDoubleArrayLengthType;
+      access.machine_type = MachineType::TaggedSigned();
+      access.write_barrier_kind = kNoWriteBarrier;
+    } else if (IsFastElementsKind(elements_kind)) {
+      access.type = TypeCache::Get().kFixedArrayLengthType;
+      access.machine_type = MachineType::TaggedSigned();
+      access.write_barrier_kind = kNoWriteBarrier;
+    } else {
+      access.type = TypeCache::Get().kJSArrayLengthType;
+    }
+  } else if (instance_type == JS_TYPED_ARRAY_TYPE) {
+    access.type = TypeCache::Get().kJSTypedArrayLengthType;
+    access.machine_type = MachineType::TaggedSigned();
+    access.write_barrier_kind = kNoWriteBarrier;
+  }
+  return access;
+}
+
+// static
+FieldAccess AccessBuilder::ForJSArrayIteratorObjectMap() {
+  FieldAccess access = {kTaggedBase,
+                        JSArrayIterator::kIteratedObjectMapOffset,
+                        Handle<Name>(),
+                        Type::OtherInternal(),
+                        MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
+  return access;
+}
+
+// static
 FieldAccess AccessBuilder::ForJSStringIteratorString() {
   FieldAccess access = {
       kTaggedBase,    JSStringIterator::kStringOffset, Handle<Name>(),
       Type::String(), MachineType::TaggedPointer(),    kPointerWriteBarrier};
   return access;
 }
 
 // static
 FieldAccess AccessBuilder::ForJSStringIteratorIndex() {
   FieldAccess access = {kTaggedBase,
@@ skipping 182 matching lines @@
   }
   UNREACHABLE();
   ElementAccess access = {kUntaggedBase, 0, Type::None(), MachineType::None(),
                           kNoWriteBarrier};
   return access;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8