[builtins] implement JSBuiltinReducer for ArrayIteratorNext()

src/builtins/builtins-array.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins.h"
 #include "src/builtins/builtins-utils.h"
 
 #include "src/code-factory.h"
 #include "src/contexts.h"
 #include "src/elements.h"
@@ skipping 2268 matching lines @@
       Node* value = assembler->LoadFixedDoubleArrayElement(
           elements, index, MachineType::Float64(), 0,
           CodeStubAssembler::SMI_PARAMETERS, &allocate_entry_if_needed);
       var_value.Bind(assembler->AllocateHeapNumberWithValue(value));
       assembler->Goto(&allocate_entry_if_needed);
     }
   }
 
   assembler->Bind(&if_isnotfastarray);
   {
-    Label if_istypedarray(assembler), if_isgeneric(assembler);
+    Label if_istypedarray(assembler), if_isgeneric(assembler),
+        invalidate_protector(assembler);

[Benedikt Meurer, 2016/11/08 05:29:48]

The invalidate_protector label is unused.

 
     // If a is undefined, return CreateIterResultObject(undefined, true)
     assembler->GotoIf(
         assembler->WordEqual(array, assembler->UndefinedConstant()),
         &allocate_iterator_result);
 
     Node* array_type = assembler->LoadInstanceType(array);
     assembler->Branch(
         assembler->Word32Equal(array_type,
                                assembler->Int32Constant(JS_TYPED_ARRAY_TYPE)),
         &if_istypedarray, &if_isgeneric);
 
     assembler->Bind(&if_isgeneric);
     {
+      Label if_wasfastarray(assembler), if_wasnotfastarray(assembler);

[Benedikt Meurer, 2016/11/08 05:29:48]

The if_wasnotfastarray label is unused.

+
       Node* length = nullptr;
       {
         Variable var_length(assembler, MachineRepresentation::kTagged);
         Label if_isarray(assembler), if_isnotarray(assembler), done(assembler);
         assembler->Branch(
             assembler->Word32Equal(array_type,
                                    assembler->Int32Constant(JS_ARRAY_TYPE)),
             &if_isarray, &if_isnotarray);
 
         assembler->Bind(&if_isarray);
         {
           var_length.Bind(
               assembler->LoadObjectField(array, JSArray::kLengthOffset));
-          assembler->Goto(&done);
+
+          // Invalidate protector cell if needed
+          assembler->Branch(
+              assembler->WordNotEqual(orig_map, assembler->UndefinedConstant()),
+              &if_wasfastarray, &done);
+
+          assembler->Bind(&if_wasfastarray);
+          {
+            Label if_invalid(assembler, Label::kDeferred);
+            // Invalidate array_iterator_protector cell if needed (Not needed
+            // for keys iteration, or if already marked as invalid)
+            assembler->StoreObjectField(
+                iterator, JSArrayIterator::kIteratedObjectMapOffset,
+                assembler->UndefinedConstant());
+            assembler->GotoIf(
+                assembler->Uint32LessThanOrEqual(
+                    instance_type, assembler->Int32Constant(
+                                       JS_GENERIC_ARRAY_KEY_ITERATOR_TYPE)),
+                &done);
+
+            Node* invalid = assembler->SmiConstant(
+                Smi::FromInt(Isolate::kArrayProtectorInvalid));
+            Node* cell =
+                assembler->LoadRoot(Heap::kArrayIteratorProtectorRootIndex);
+            Node* cell_value =
+                assembler->LoadObjectField(cell, PropertyCell::kValueOffset);
+            assembler->Branch(assembler->WordEqual(cell_value, invalid), &done,
+                              &if_invalid);
+
+            assembler->Bind(&if_invalid);
+            assembler->CallRuntime(Runtime::kInvalidateArrayIteratorProtector,
+                                   context);
+            assembler->Goto(&done);
+          }
         }
 
         assembler->Bind(&if_isnotarray);
         {
           Node* length_string = assembler->HeapConstant(
               assembler->isolate()->factory()->length_string());
           Callable get_property =
               CodeFactory::GetProperty(assembler->isolate());
           Node* length =
               assembler->CallStub(get_property, context, array, length_string);
@@ skipping 42 matching lines @@
 
         assembler->Bind(&if_isnotdetached);
         {
           var_length.Bind(
               assembler->LoadObjectField(array, JSTypedArray::kLengthOffset));
           assembler->Goto(&done);
         }
 
         assembler->Bind(&if_isdetached);
         {
+          // TODO(caitp): If IsDetached(buffer) is true, throw a TypeError, per
+          // https://github.com/tc39/ecma262/issues/713
           var_length.Bind(assembler->SmiConstant(Smi::kZero));
           assembler->Goto(&done);
         }
 
         assembler->Bind(&done);
         length = var_length.value();
       }
       assembler->Assert(assembler->TaggedIsSmi(length));
       assembler->Assert(assembler->TaggedIsSmi(index));
 
@@ skipping 193 matching lines @@
         Runtime::kThrowIncompatibleMethodReceiver, context,
         assembler->HeapConstant(assembler->factory()->NewStringFromAsciiChecked(
             "Array Iterator.prototype.next", TENURED)),
         iterator);
     assembler->Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8