[builtins] implement JSBuiltinReducer for ArrayIteratorNext()

src/compiler/access-builder.cc

Index: src/compiler/access-builder.cc
diff --git a/src/compiler/access-builder.cc b/src/compiler/access-builder.cc
index 530143440d52e4726bbceeabc2fe495023c7886e..02ae6673d75ba44b9bccc9de5f1ed7a7df7ca2d6 100644
--- a/src/compiler/access-builder.cc
+++ b/src/compiler/access-builder.cc
@@ -549,6 +549,54 @@ FieldAccess AccessBuilder::ForJSGlobalObjectNativeContext() {
 }
 
 // static
+FieldAccess AccessBuilder::ForJSArrayIteratorObject() {
+  FieldAccess access = {kTaggedBase,
+                        JSArrayIterator::kIteratedObjectOffset,
+                        Handle<Name>(),
+                        Type::Receiver(),
+                        MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
+  return access;
+}
+
+// static
+FieldAccess AccessBuilder::ForJSArrayIteratorIndex(InstanceType instance_type,
+                                                   ElementsKind elements_kind) {
+  FieldAccess access = {kTaggedBase,
+                        JSArrayIterator::kIteratedObjectOffset,
+                        Handle<Name>(),
+                        TypeCache::Get().kPositiveSafeInteger,

[Benedikt Meurer, 2016/11/08 05:29:48]

Actually it can be any positive integer, not only the safe integer range.

[caitp, 2016/11/08 06:37:36]

I think `ToLength(<array length>)` should restrict the length to max safe
integer, doesn't it? Since the [[NextIndex]] field should never exceed the
highest possible length (which for generic arrays can be up to 2^53-1)

+                        MachineType::TaggedSigned(),

[Benedikt Meurer, 2016/11/08 05:29:48]

The general type is MachineType::AnyTagged()

[caitp, 2016/11/08 06:37:36]

Acknowledged.

+                        kFullWriteBarrier};
+  if (instance_type == JS_ARRAY_TYPE) {
+    if (IsFastDoubleElementsKind(elements_kind)) {
+      access.type = TypeCache::Get().kFixedDoubleArrayLengthType;
+      access.write_barrier_kind = kNoWriteBarrier;

[Benedikt Meurer, 2016/11/08 05:29:48]

Set access.machine_type = MachineType::TaggedSigned() here.

[caitp, 2016/11/08 06:37:35]

Acknowledged.

+    } else if (IsFastElementsKind(elements_kind)) {
+      access.type = TypeCache::Get().kFixedArrayLengthType;
+      access.write_barrier_kind = kNoWriteBarrier;

[Benedikt Meurer, 2016/11/08 05:29:48]

Set access.machine_type = MachineType::TaggedSigned() here.

[caitp, 2016/11/08 06:37:36]

Acknowledged.

+    } else {
+      access.type = TypeCache::Get().kJSArrayLengthType;
+    }
+  } else if (instance_type == JS_TYPED_ARRAY_TYPE) {
+    access.type = TypeCache::Get().kJSTypedArrayLengthType;

[Benedikt Meurer, 2016/11/08 05:29:48]

Set access.machine_type = MachineType::TaggedSigned() here.

[caitp, 2016/11/08 06:37:36]

Acknowledged.

+    access.write_barrier_kind = kNoWriteBarrier;
+  }
+  return access;
+}
+
+// static
+FieldAccess AccessBuilder::ForJSArrayIteratorObjectMap() {
+  FieldAccess access = {kTaggedBase,
+                        JSArrayIterator::kIteratedObjectMapOffset,
+                        Handle<Name>(),
+                        Type::OtherInternal(),
+                        MachineType::TaggedPointer(),
+                        kPointerWriteBarrier};
+  return access;
+}
+
+// static
 FieldAccess AccessBuilder::ForJSStringIteratorString() {
   FieldAccess access = {
       kTaggedBase,    JSStringIterator::kStringOffset, Handle<Name>(),