[builtins] implement JSBuiltinReducer for ArrayIteratorNext()

src/compiler/access-builder.cc

Index: src/compiler/access-builder.cc
diff --git a/src/compiler/access-builder.cc b/src/compiler/access-builder.cc
index 530143440d52e4726bbceeabc2fe495023c7886e..a2f0acd54a1936e921488d8fb1151f0f408c0e9b 100644
--- a/src/compiler/access-builder.cc
+++ b/src/compiler/access-builder.cc
@@ -549,6 +549,57 @@ FieldAccess AccessBuilder::ForJSGlobalObjectNativeContext() {
 }
 
 // static
+FieldAccess AccessBuilder::ForJSArrayIteratorObject() {
+  FieldAccess access = {kTaggedBase,
+                        JSArrayIterator::kIteratedObjectOffset,
+                        Handle<Name>(),
+                        Type::ReceiverOrUndefined(),

[Benedikt Meurer, 2016/11/09 20:00:32]

Note for later changes/direction: I've been chatting about this with Camillo
offline today, and I think we might want to change this aspect of the spec in
the future (or violate the spec here), as the undefined clearing of the internal
object slot causes a lot of trouble, for example, the load/check elimination
cannot really eliminate the LoadField for the object in each iteration, because
it can also be undefined, and thus we cannot just eliminate the map check
(unless we also do some heavy tracking of information along the control chain).
Plus this part of the spec is only concerned about resource management, and
that's not the business of the language spec.

So nothing to change for now (esp. not for this CL), but some heads up for the
future.

[caitp, 2016/11/09 20:55:24]

Acknowledged.

+                        MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
+  return access;
+}
+
+// static
+FieldAccess AccessBuilder::ForJSArrayIteratorIndex(InstanceType instance_type,
+                                                   ElementsKind elements_kind) {
+  FieldAccess access = {kTaggedBase,
+                        JSArrayIterator::kNextIndexOffset,
+                        Handle<Name>(),
+                        TypeCache::Get().kPositiveSafeInteger,

[Benedikt Meurer, 2016/11/09 20:00:32]

s/kPositiveSafeInteger/kPositiveInteger/

[caitp, 2016/11/09 20:55:24]

Iteration stops if index >= ToLength(array.[[Get]]("length")), doesn't that cap
this to 2^53-1, since the index is never incremented in that situation?

Done for now, but we could I think it's valid to narrow the range of values a
bit

[Benedikt Meurer, 2016/11/10 04:49:55]

Good point, you are right, thanks for the explanation. So feel free to change it
back (and maybe add a comment why this is safe).

+                        MachineType::AnyTagged(),
+                        kFullWriteBarrier};
+  if (instance_type == JS_ARRAY_TYPE) {
+    if (IsFastDoubleElementsKind(elements_kind)) {
+      access.type = TypeCache::Get().kFixedDoubleArrayLengthType;
+      access.machine_type = MachineType::TaggedSigned();
+      access.write_barrier_kind = kNoWriteBarrier;
+    } else if (IsFastElementsKind(elements_kind)) {
+      access.type = TypeCache::Get().kFixedArrayLengthType;
+      access.machine_type = MachineType::TaggedSigned();
+      access.write_barrier_kind = kNoWriteBarrier;
+    } else {
+      access.type = TypeCache::Get().kJSArrayLengthType;
+    }
+  } else if (instance_type == JS_TYPED_ARRAY_TYPE) {
+    access.type = TypeCache::Get().kJSTypedArrayLengthType;
+    access.machine_type = MachineType::TaggedSigned();
+    access.write_barrier_kind = kNoWriteBarrier;
+  }
+  return access;
+}
+
+// static
+FieldAccess AccessBuilder::ForJSArrayIteratorObjectMap() {
+  FieldAccess access = {kTaggedBase,
+                        JSArrayIterator::kIteratedObjectMapOffset,
+                        Handle<Name>(),
+                        Type::OtherInternal(),
+                        MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
+  return access;
+}
+
+// static
 FieldAccess AccessBuilder::ForJSStringIteratorString() {
   FieldAccess access = {
       kTaggedBase,    JSStringIterator::kStringOffset, Handle<Name>(),