[WIP] JSForInLowering and JSForInHasOwnProperty.

src/compiler/js-call-reducer.cc

Index: src/compiler/js-call-reducer.cc
diff --git a/src/compiler/js-call-reducer.cc b/src/compiler/js-call-reducer.cc
index 21148b3d20d6351d82cbbc3913745762129b52b1..47b60e447e7098fbec28f1dbc25fd1ce59b6f91b 100644
--- a/src/compiler/js-call-reducer.cc
+++ b/src/compiler/js-call-reducer.cc
@@ -303,6 +303,37 @@ JSCallReducer::HolderLookup JSCallReducer::LookupHolder(
   return kHolderNotFound;
 }
 
+// ES6 section 19.1.3.2 Object.prototype.hasOwnProperty
+Reduction JSCallReducer::ReduceObjectPrototypeHasOwnProperty(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& params = CallParametersOf(node->op());
+  if (params.arity() != 3) return NoChange();
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* name = NodeProperties::GetValueInput(node, 2);
+
+  // We can optimize a call to Object.prototype.hasOwnProperty if it's being
+  // used inside a for..in, so for code like this:
+  //
+  //   for (name in receiver) {
+  //     if (receiver.hasOwnProperty(name)) {
+  //        ...
+  //     }
+  //   }
+  if (name->opcode() == IrOpcode::kJSForInNext) {
+    Node* object = NodeProperties::GetValueInput(name, 0);
+    Node* enumerator = NodeProperties::GetValueInput(name, 2);
+    if (object == receiver || (object->opcode() == IrOpcode::kJSToObject &&
+                               object->InputAt(0) == receiver)) {
+      node->ReplaceInput(1, object);
+      node->InsertInput(graph()->zone(), 3, enumerator);
+      NodeProperties::ChangeOp(node, javascript()->ForInHasOwnProperty());
+      return Changed(node);
+    }
+  }
+
+  return NoChange();
+}
+
 // ES6 section B.2.2.1.1 get Object.prototype.__proto__
 Reduction JSCallReducer::ReduceObjectPrototypeGetProto(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
@@ -533,6 +564,8 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
           return ReduceFunctionPrototypeHasInstance(node);
         case Builtins::kNumberConstructor:
           return ReduceNumberConstructor(node);
+        case Builtins::kObjectHasOwnProperty:
+          return ReduceObjectPrototypeHasOwnProperty(node);
         case Builtins::kObjectPrototypeGetProto:
           return ReduceObjectPrototypeGetProto(node);
         default: