[builtins] Take fast path in Array.prototype.keys() only if length is an Smi

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 #include "src/ic/handler-configuration.h"
 #include "src/ic/stub-cache.h"
 
@@ skipping 8832 matching lines @@
   Variable var_map_index(this, MachineType::PointerRepresentation());
   Variable var_array_map(this, MachineRepresentation::kTagged);
 
   Label return_result(this);
   Label allocate_iterator(this);
 
   if (mode == IterationKind::kKeys) {
     // There are only two key iterator maps, branch depending on whether or not
     // the receiver is a TypedArray or not.
 
-    Label if_isarray(this), if_istypedarray(this), if_isgeneric(this);
-    Label* kInstanceTypeHandlers[] = {&if_isarray, &if_istypedarray};
+    Label if_istypedarray(this), if_isgeneric(this);
 
-    static int32_t kInstanceType[] = {JS_ARRAY_TYPE, JS_TYPED_ARRAY_TYPE};
+    Branch(Word32Equal(array_type, Int32Constant(JS_TYPED_ARRAY_TYPE)),
+           &if_istypedarray, &if_isgeneric);
 
-    Switch(array_type, &if_isgeneric, kInstanceType, kInstanceTypeHandlers,
-           arraysize(kInstanceType));
+    Bind(&if_isgeneric);
+    {
+      Label if_isfast(this), if_isslow(this);
+      BranchIfFastJSArray(array, context, &if_isfast, &if_isslow);
 
-    Bind(&if_isarray);
-    {
-      var_map_index.Bind(
-          IntPtrConstant(Context::FAST_ARRAY_KEY_ITERATOR_MAP_INDEX));
-      var_array_map.Bind(array_map);
-      Goto(&allocate_iterator);
+      Bind(&if_isfast);
+      {
+        var_map_index.Bind(
+            IntPtrConstant(Context::FAST_ARRAY_KEY_ITERATOR_MAP_INDEX));
+        var_array_map.Bind(array_map);
+        Goto(&allocate_iterator);
+      }
+
+      Bind(&if_isslow);
+      {
+        var_map_index.Bind(
+            IntPtrConstant(Context::GENERIC_ARRAY_KEY_ITERATOR_MAP_INDEX));
+        var_array_map.Bind(UndefinedConstant());
+        Goto(&allocate_iterator);
+      }
     }
 
     Bind(&if_istypedarray);
     {
       var_map_index.Bind(
           IntPtrConstant(Context::TYPED_ARRAY_KEY_ITERATOR_MAP_INDEX));
       var_array_map.Bind(UndefinedConstant());
       Goto(&allocate_iterator);
     }
-
-    Bind(&if_isgeneric);
-    {
-      var_map_index.Bind(
-          IntPtrConstant(Context::GENERIC_ARRAY_KEY_ITERATOR_MAP_INDEX));
-      var_array_map.Bind(UndefinedConstant());
-      Goto(&allocate_iterator);
-    }
   } else {
     Label if_istypedarray(this), if_isgeneric(this);
     Branch(Word32Equal(array_type, Int32Constant(JS_TYPED_ARRAY_TYPE)),
            &if_istypedarray, &if_isgeneric);
 
     Bind(&if_isgeneric);
     {
       Label if_isfast(this), if_isslow(this);
       BranchIfFastJSArray(array, context, &if_isfast, &if_isslow);
 
@@ skipping 206 matching lines @@
   STATIC_ASSERT(FAST_HOLEY_ELEMENTS == (FAST_ELEMENTS | 1));
   STATIC_ASSERT(FAST_HOLEY_DOUBLE_ELEMENTS == (FAST_DOUBLE_ELEMENTS | 1));
 
   // Check prototype chain if receiver does not have packed elements.
   Node* holey_elements = Word32And(elements_kind, Int32Constant(1));
   return Word32Equal(holey_elements, Int32Constant(1));
 }
 
 }  // namespace internal
 }  // namespace v8