[WIP] JSForInLowering and JSForInHasOwnProperty.

src/compiler/js-native-context-specialization.cc

Index: src/compiler/js-native-context-specialization.cc
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
index d54a67add1210aac004ae9790f872c551db186d2..f32554eb440837d02e7e852a05e48b8d3bb0cbbd 100644
--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -1274,15 +1274,37 @@ Reduction JSNativeContextSpecialization::ReduceSoftDeoptimize(
 Reduction JSNativeContextSpecialization::ReduceJSLoadProperty(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadProperty, node->opcode());
   PropertyAccess const& p = PropertyAccessOf(node->op());
-  Node* const index = NodeProperties::GetValueInput(node, 1);
+  Node* const receiver = NodeProperties::GetValueInput(node, 0);
+  Node* const name = NodeProperties::GetValueInput(node, 1);
   Node* const value = jsgraph()->Dead();
 
+  // We can optimize a property load if it's being used inside a for..in, so
+  // for code like this:
+  //
+  //   for (name in receiver) {
+  //     value = receiver[name];
+  //     ...
+  //   }
+  if (name->opcode() == IrOpcode::kJSForInNext) {
+    Node* object = NodeProperties::GetValueInput(name, 0);
+    Node* enumerator = NodeProperties::GetValueInput(name, 2);
+    Node* index = NodeProperties::GetValueInput(name, 3);
+    if (object == receiver || (object->opcode() == IrOpcode::kJSToObject &&
+                               object->InputAt(0) == receiver)) {
+      node->ReplaceInput(0, object);
+      node->InsertInput(graph()->zone(), 2, enumerator);
+      node->InsertInput(graph()->zone(), 3, index);
+      NodeProperties::ChangeOp(node, javascript()->ForInLoadProperty());
+      return Changed(node);
+    }
+  }
+
   // Extract receiver maps from the KEYED_LOAD_IC using the KeyedLoadICNexus.
   if (!p.feedback().IsValid()) return NoChange();
   KeyedLoadICNexus nexus(p.feedback().vector(), p.feedback().slot());
 
   // Try to lower the keyed access based on the {nexus}.
-  return ReduceKeyedAccess(node, index, value, nexus, AccessMode::kLoad,
+  return ReduceKeyedAccess(node, name, value, nexus, AccessMode::kLoad,
                            p.language_mode(), STANDARD_STORE);
 }