[WIP] JSForInLowering and JSForInHasOwnProperty.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 34deb8e03cdcbb9cc1d86fa4c3355bf605346d1e..481b5f0a73a469c71495d2f617dc3b4e9806f574 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -2139,92 +2139,6 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
   return NoChange();
 }
 
-
-Reduction JSTypedLowering::ReduceJSForInNext(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSForInNext, node->opcode());
-  Node* receiver = NodeProperties::GetValueInput(node, 0);
-  Node* cache_array = NodeProperties::GetValueInput(node, 1);
-  Node* cache_type = NodeProperties::GetValueInput(node, 2);
-  Node* index = NodeProperties::GetValueInput(node, 3);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-
-  // We know that the {index} is in Unsigned32 range here, otherwise executing
-  // the JSForInNext wouldn't be valid. Unfortunately due to OSR and generators
-  // this is not always reflected in the types, hence we might need to rename
-  // the {index} here.
-  if (!NodeProperties::GetType(index)->Is(Type::Unsigned32())) {
-    index = graph()->NewNode(common()->TypeGuard(Type::Unsigned32()), index,
-                             control);
-  }
-
-  // Load the next {key} from the {cache_array}.
-  Node* key = effect = graph()->NewNode(
-      simplified()->LoadElement(AccessBuilder::ForFixedArrayElement()),
-      cache_array, index, effect, control);
-
-  // Load the map of the {receiver}.
-  Node* receiver_map = effect =
-      graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
-                       receiver, effect, control);
-
-  // Check if the expected map still matches that of the {receiver}.
-  Node* check0 = graph()->NewNode(simplified()->ReferenceEqual(), receiver_map,
-                                  cache_type);
-  Node* branch0 =
-      graph()->NewNode(common()->Branch(BranchHint::kTrue), check0, control);
-
-  Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
-  Node* etrue0;
-  Node* vtrue0;
-  {
-    // Don't need filtering since expected map still matches that of the
-    // {receiver}.
-    etrue0 = effect;
-    vtrue0 = key;
-  }
-
-  Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
-  Node* efalse0;
-  Node* vfalse0;
-  {
-    // Filter the {key} to check if it's still a valid property of the
-    // {receiver} (does the ToName conversion implicitly).
-    Callable const callable = CodeFactory::ForInFilter(isolate());
-    CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
-        isolate(), graph()->zone(), callable.descriptor(), 0,
-        CallDescriptor::kNeedsFrameState);
-    vfalse0 = efalse0 = if_false0 = graph()->NewNode(
-        common()->Call(desc), jsgraph()->HeapConstant(callable.code()), key,
-        receiver, context, frame_state, effect, if_false0);
-
-    // Update potential {IfException} uses of {node} to point to the ahove
-    // ForInFilter stub call node instead.
-    Node* if_exception = nullptr;
-    if (NodeProperties::IsExceptionalCall(node, &if_exception)) {
-      if_false0 = graph()->NewNode(common()->IfSuccess(), vfalse0);
-      NodeProperties::ReplaceControlInput(if_exception, vfalse0);
-      NodeProperties::ReplaceEffectInput(if_exception, efalse0);
-      Revisit(if_exception);
-    }
-  }
-
-  control = graph()->NewNode(common()->Merge(2), if_true0, if_false0);
-  effect = graph()->NewNode(common()->EffectPhi(2), etrue0, efalse0, control);
-  ReplaceWithValue(node, node, effect, control);
-
-  // Morph the {node} into a Phi.
-  node->ReplaceInput(0, vtrue0);
-  node->ReplaceInput(1, vfalse0);
-  node->ReplaceInput(2, control);
-  node->TrimInputCount(3);
-  NodeProperties::ChangeOp(node,
-                           common()->Phi(MachineRepresentation::kTagged, 2));
-  return Changed(node);
-}
-
 Reduction JSTypedLowering::ReduceJSLoadMessage(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadMessage, node->opcode());
   ExternalReference const ref =
@@ -2393,8 +2307,6 @@ Reduction JSTypedLowering::Reduce(Node* node) {
       return ReduceJSCallForwardVarargs(node);
     case IrOpcode::kJSCall:
       return ReduceJSCall(node);
-    case IrOpcode::kJSForInNext:
-      return ReduceJSForInNext(node);
     case IrOpcode::kJSLoadMessage:
       return ReduceJSLoadMessage(node);
     case IrOpcode::kJSStoreMessage: