[builtins] implement JSBuiltinReducer for ArrayIteratorNext()

src/isolate.cc

Index: src/isolate.cc
diff --git a/src/isolate.cc b/src/isolate.cc
index 995b2628becda2e6e9ead6f69e46c4563636535e..66c7341bddafc11f31ffdc0d68f01e8491b3fefd 100644
--- a/src/isolate.cc
+++ b/src/isolate.cc
@@ -2951,6 +2951,14 @@ void Isolate::InvalidateStringLengthOverflowProtector() {
   DCHECK(!IsStringLengthOverflowIntact());
 }
 
+void Isolate::InvalidateArrayIteratorProtector() {

[Camillo Bruni, 2016/11/09 12:03:49]

You may want to wire this to LookupIterator::InternalUpdateProtector

[caitp, 2016/11/09 17:40:16]

this cell isn't changed during lookup, it's changed if a fast array map used by
the array iterator transitions to a slow one --- the iterator implementations
handle it manually. I think it's okay to not wire it up to anything

+  DCHECK(factory()->array_iterator_protector()->value()->IsSmi());
+  DCHECK(CanInlineArrayIterator());
+  factory()->array_iterator_protector()->set_value(
+      Smi::FromInt(kArrayProtectorInvalid));
+  DCHECK(!CanInlineArrayIterator());
+}
+
 bool Isolate::IsAnyInitialArrayPrototype(Handle<JSArray> array) {
   DisallowHeapAllocation no_gc;
   return IsInAnyContext(*array, Context::INITIAL_ARRAY_PROTOTYPE_INDEX);