[WIP] JSForInLowering and JSForInHasOwnProperty.

src/compiler/js-call-reducer.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-call-reducer.h"
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/js-graph.h"
@@ skipping 285 matching lines @@
     Handle<JSObject> prototype(JSObject::cast(object_map->prototype()));
     object_map = handle(prototype->map());
     if (expected_receiver_type->IsTemplateFor(*object_map)) {
       *holder = prototype;
       return kHolderFound;
     }
   }
   return kHolderNotFound;
 }
 
+// ES6 section 19.1.3.2 Object.prototype.hasOwnProperty
+Reduction JSCallReducer::ReduceObjectPrototypeHasOwnProperty(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& params = CallParametersOf(node->op());
+  if (params.arity() != 3) return NoChange();
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* name = NodeProperties::GetValueInput(node, 2);
+
+  // We can optimize a call to Object.prototype.hasOwnProperty if it's being
+  // used inside a for..in, so for code like this:
+  //
+  //   for (name in receiver) {
+  //     if (receiver.hasOwnProperty(name)) {
+  //        ...
+  //     }
+  //   }
+  if (name->opcode() == IrOpcode::kJSForInNext) {
+    Node* object = NodeProperties::GetValueInput(name, 0);
+    Node* enumerator = NodeProperties::GetValueInput(name, 2);
+    if (object == receiver || (object->opcode() == IrOpcode::kJSToObject &&
+                               object->InputAt(0) == receiver)) {
+      node->ReplaceInput(1, object);
+      node->InsertInput(graph()->zone(), 3, enumerator);
+      NodeProperties::ChangeOp(node, javascript()->ForInHasOwnProperty());
+      return Changed(node);
+    }
+  }
+
+  return NoChange();
+}
+
 // ES6 section B.2.2.1.1 get Object.prototype.__proto__
 Reduction JSCallReducer::ReduceObjectPrototypeGetProto(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
 
   // Try to determine the {receiver} map.
   ZoneHandleSet<Map> receiver_maps;
   if (NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps)) {
     Handle<Map> candidate_map(
@@ skipping 210 matching lines @@
       // Check for known builtin functions.
       switch (shared->code()->builtin_index()) {
         case Builtins::kFunctionPrototypeApply:
           return ReduceFunctionPrototypeApply(node);
         case Builtins::kFunctionPrototypeCall:
           return ReduceFunctionPrototypeCall(node);
         case Builtins::kFunctionPrototypeHasInstance:
           return ReduceFunctionPrototypeHasInstance(node);
         case Builtins::kNumberConstructor:
           return ReduceNumberConstructor(node);
+        case Builtins::kObjectHasOwnProperty:
+          return ReduceObjectPrototypeHasOwnProperty(node);
         case Builtins::kObjectPrototypeGetProto:
           return ReduceObjectPrototypeGetProto(node);
         default:
           break;
       }
 
       // Check for the Array constructor.
       if (*function == function->native_context()->array_function()) {
         return ReduceArrayConstructor(node);
       }
@@ skipping 260 matching lines @@
   return jsgraph()->javascript();
 }
 
 SimplifiedOperatorBuilder* JSCallReducer::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8