[builtins] Properly optimize Object.prototype.isPrototypeOf.

src/builtins/builtins-object-gen.cc

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/code-stub-assembler.h"
 
 namespace v8 {
 namespace internal {
@@ skipping 174 matching lines @@
     Node* native_context = LoadNativeContext(context);
     Node* array_map = LoadJSArrayElementsMap(FAST_ELEMENTS, native_context);
     Node* array = AllocateUninitializedJSArrayWithoutElements(
         FAST_ELEMENTS, array_map, var_length.value(), nullptr);
     StoreObjectFieldNoWriteBarrier(array, JSArray::kElementsOffset,
                                    var_elements.value());
     Return(array);
   }
 }
 
+// ES #sec-object.prototype.isprototypeof
+TF_BUILTIN(ObjectPrototypeIsPrototypeOf, ObjectBuiltinsAssembler) {
+  Node* receiver = Parameter(Descriptor::kReceiver);
+  Node* value = Parameter(Descriptor::kValue);
+  Node* context = Parameter(Descriptor::kContext);
+  Label if_receiverisnullorundefined(this, Label::kDeferred),
+      if_valueisnotreceiver(this, Label::kDeferred);
+
+  // We only check whether {value} is a Smi here, so that the
+  // prototype chain walk below can safely access the {value}s
+  // map. We don't rule out Primitive {value}s, since all of
+  // them have null as their prototype, so the chain walk below
+  // immediately aborts and returns false anyways.
+  GotoIf(TaggedIsSmi(value), &if_valueisnotreceiver);
+
+  // Check if {receiver} is either null or undefined and in that case,
+  // invoke the ToObject builtin, which raises the appropriate error.
+  // Otherwise we don't need to invoke ToObject, since {receiver} is
+  // either already a JSReceiver, in which case ToObject is a no-op,
+  // or it's a Primitive and ToObject would allocate a fresh JSValue
+  // wrapper, which wouldn't be identical to any existing JSReceiver
+  // found in the prototype chain of {value}, hence it will return
+  // false no matter if we search for the Primitive {receiver} or
+  // a newly allocated JSValue wrapper for {receiver}.
+  GotoIf(IsNull(receiver), &if_receiverisnullorundefined);
+  GotoIf(IsUndefined(receiver), &if_receiverisnullorundefined);
+
+  // Loop through the prototype chain looking for the {receiver}.
+  Return(HasInPrototypeChain(context, value, receiver));
+
+  BIND(&if_receiverisnullorundefined);
+  {
+    // If {value} is a primitive HeapObject, we need to return
+    // false instead of throwing an exception per order of the
+    // steps in the specification, so check that first here.
+    GotoIfNot(IsJSReceiver(value), &if_valueisnotreceiver);
+
+    // Simulate the ToObject invocation on {receiver}.
+    CallBuiltin(Builtins::kToObject, context, receiver);
+    Unreachable();
+  }
+
+  BIND(&if_valueisnotreceiver);
+  Return(FalseConstant());
+}
+
 // ES6 #sec-object.prototype.tostring
 TF_BUILTIN(ObjectProtoToString, ObjectBuiltinsAssembler) {
   Label return_undefined(this, Label::kDeferred),
       return_null(this, Label::kDeferred),
       return_arguments(this, Label::kDeferred), return_array(this),
       return_api(this, Label::kDeferred), return_object(this),
       return_regexp(this), return_function(this), return_error(this),
       return_date(this), return_jsvalue(this),
       return_jsproxy(this, Label::kDeferred);
 
@@ skipping 332 matching lines @@
 
   BIND(&runtime);
   {
     Return(CallRuntime(Runtime::kCreateJSGeneratorObject, context, closure,
                        receiver));
   }
 }
 
 }  // namespace internal
 }  // namespace v8