[WIP] JSForInLowering and JSForInHasOwnProperty.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 1256 matching lines @@
   Revisit(graph()->end());
   node->TrimInputCount(0);
   NodeProperties::ChangeOp(node, common()->Dead());
   return Changed(node);
 }
 
 
 Reduction JSNativeContextSpecialization::ReduceJSLoadProperty(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadProperty, node->opcode());
   PropertyAccess const& p = PropertyAccessOf(node->op());
-  Node* const index = NodeProperties::GetValueInput(node, 1);
+  Node* const receiver = NodeProperties::GetValueInput(node, 0);
+  Node* const name = NodeProperties::GetValueInput(node, 1);
   Node* const value = jsgraph()->Dead();
 
+  // We can optimize a property load if it's being used inside a for..in, so
+  // for code like this:
+  //
+  //   for (name in receiver) {
+  //     value = receiver[name];
+  //     ...
+  //   }
+  if (name->opcode() == IrOpcode::kJSForInNext) {
+    Node* object = NodeProperties::GetValueInput(name, 0);
+    Node* enumerator = NodeProperties::GetValueInput(name, 2);
+    Node* index = NodeProperties::GetValueInput(name, 3);
+    if (object == receiver || (object->opcode() == IrOpcode::kJSToObject &&
+                               object->InputAt(0) == receiver)) {
+      node->ReplaceInput(0, object);
+      node->InsertInput(graph()->zone(), 2, enumerator);
+      node->InsertInput(graph()->zone(), 3, index);
+      NodeProperties::ChangeOp(node, javascript()->ForInLoadProperty());
+      return Changed(node);
+    }
+  }
+
   // Extract receiver maps from the KEYED_LOAD_IC using the KeyedLoadICNexus.
   if (!p.feedback().IsValid()) return NoChange();
   KeyedLoadICNexus nexus(p.feedback().vector(), p.feedback().slot());
 
   // Try to lower the keyed access based on the {nexus}.
-  return ReduceKeyedAccess(node, index, value, nexus, AccessMode::kLoad,
+  return ReduceKeyedAccess(node, name, value, nexus, AccessMode::kLoad,
                            p.language_mode(), STANDARD_STORE);
 }
 
 
 Reduction JSNativeContextSpecialization::ReduceJSStoreProperty(Node* node) {
   DCHECK_EQ(IrOpcode::kJSStoreProperty, node->opcode());
   PropertyAccess const& p = PropertyAccessOf(node->op());
   Node* const index = NodeProperties::GetValueInput(node, 1);
   Node* const value = NodeProperties::GetValueInput(node, 2);
 
@@ skipping 1019 matching lines @@
   return jsgraph()->javascript();
 }
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8