[WIP] JSForInLowering and JSForInHasOwnProperty.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-typed-lowering.h"
 
 #include "src/ast/modules.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
@@ skipping 2121 matching lines @@
     NodeProperties::ChangeOp(
         node,
         javascript()->Call(p.arity(), p.frequency(), p.feedback(), convert_mode,
                            p.tail_call_mode()));
     return Changed(node);
   }
 
   return NoChange();
 }
 
-
-Reduction JSTypedLowering::ReduceJSForInNext(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSForInNext, node->opcode());
-  Node* receiver = NodeProperties::GetValueInput(node, 0);
-  Node* cache_array = NodeProperties::GetValueInput(node, 1);
-  Node* cache_type = NodeProperties::GetValueInput(node, 2);
-  Node* index = NodeProperties::GetValueInput(node, 3);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-
-  // We know that the {index} is in Unsigned32 range here, otherwise executing
-  // the JSForInNext wouldn't be valid. Unfortunately due to OSR and generators
-  // this is not always reflected in the types, hence we might need to rename
-  // the {index} here.
-  if (!NodeProperties::GetType(index)->Is(Type::Unsigned32())) {
-    index = graph()->NewNode(common()->TypeGuard(Type::Unsigned32()), index,
-                             control);
-  }
-
-  // Load the next {key} from the {cache_array}.
-  Node* key = effect = graph()->NewNode(
-      simplified()->LoadElement(AccessBuilder::ForFixedArrayElement()),
-      cache_array, index, effect, control);
-
-  // Load the map of the {receiver}.
-  Node* receiver_map = effect =
-      graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
-                       receiver, effect, control);
-
-  // Check if the expected map still matches that of the {receiver}.
-  Node* check0 = graph()->NewNode(simplified()->ReferenceEqual(), receiver_map,
-                                  cache_type);
-  Node* branch0 =
-      graph()->NewNode(common()->Branch(BranchHint::kTrue), check0, control);
-
-  Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
-  Node* etrue0;
-  Node* vtrue0;
-  {
-    // Don't need filtering since expected map still matches that of the
-    // {receiver}.
-    etrue0 = effect;
-    vtrue0 = key;
-  }
-
-  Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
-  Node* efalse0;
-  Node* vfalse0;
-  {
-    // Filter the {key} to check if it's still a valid property of the
-    // {receiver} (does the ToName conversion implicitly).
-    Callable const callable = CodeFactory::ForInFilter(isolate());
-    CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
-        isolate(), graph()->zone(), callable.descriptor(), 0,
-        CallDescriptor::kNeedsFrameState);
-    vfalse0 = efalse0 = if_false0 = graph()->NewNode(
-        common()->Call(desc), jsgraph()->HeapConstant(callable.code()), key,
-        receiver, context, frame_state, effect, if_false0);
-
-    // Update potential {IfException} uses of {node} to point to the ahove
-    // ForInFilter stub call node instead.
-    Node* if_exception = nullptr;
-    if (NodeProperties::IsExceptionalCall(node, &if_exception)) {
-      if_false0 = graph()->NewNode(common()->IfSuccess(), vfalse0);
-      NodeProperties::ReplaceControlInput(if_exception, vfalse0);
-      NodeProperties::ReplaceEffectInput(if_exception, efalse0);
-      Revisit(if_exception);
-    }
-  }
-
-  control = graph()->NewNode(common()->Merge(2), if_true0, if_false0);
-  effect = graph()->NewNode(common()->EffectPhi(2), etrue0, efalse0, control);
-  ReplaceWithValue(node, node, effect, control);
-
-  // Morph the {node} into a Phi.
-  node->ReplaceInput(0, vtrue0);
-  node->ReplaceInput(1, vfalse0);
-  node->ReplaceInput(2, control);
-  node->TrimInputCount(3);
-  NodeProperties::ChangeOp(node,
-                           common()->Phi(MachineRepresentation::kTagged, 2));
-  return Changed(node);
-}
-
 Reduction JSTypedLowering::ReduceJSLoadMessage(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadMessage, node->opcode());
   ExternalReference const ref =
       ExternalReference::address_of_pending_message_obj(isolate());
   node->ReplaceInput(0, jsgraph()->ExternalConstant(ref));
   NodeProperties::ChangeOp(
       node, simplified()->LoadField(AccessBuilder::ForExternalTaggedValue()));
   return Changed(node);
 }
 
@@ skipping 148 matching lines @@
     case IrOpcode::kJSStoreModule:
       return ReduceJSStoreModule(node);
     case IrOpcode::kJSConvertReceiver:
       return ReduceJSConvertReceiver(node);
     case IrOpcode::kJSConstruct:
       return ReduceJSConstruct(node);
     case IrOpcode::kJSCallForwardVarargs:
       return ReduceJSCallForwardVarargs(node);
     case IrOpcode::kJSCall:
       return ReduceJSCall(node);
-    case IrOpcode::kJSForInNext:
-      return ReduceJSForInNext(node);
     case IrOpcode::kJSLoadMessage:
       return ReduceJSLoadMessage(node);
     case IrOpcode::kJSStoreMessage:
       return ReduceJSStoreMessage(node);
     case IrOpcode::kJSGeneratorStore:
       return ReduceJSGeneratorStore(node);
     case IrOpcode::kJSGeneratorRestoreContinuation:
       return ReduceJSGeneratorRestoreContinuation(node);
     case IrOpcode::kJSGeneratorRestoreRegister:
       return ReduceJSGeneratorRestoreRegister(node);
@@ skipping 40 matching lines @@
 }
 
 
 CompilationDependencies* JSTypedLowering::dependencies() const {
   return dependencies_;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8