Introduce a PrototypeIterator template and use it all over the place

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index 6c3e3c742b3507b45497550afcc712e52b502c96..f1538d4bda5ac7218faed2332c9155e3fa5faf2b 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -14,6 +14,7 @@
 #include "src/heap-profiler.h"
 #include "src/ic-inl.h"
 #include "src/mark-compact.h"
+#include "src/prototype-iterator.h"
 #include "src/stub-cache.h"
 #include "src/vm-state-inl.h"
 
@@ -253,12 +254,12 @@ static bool ArrayPrototypeHasNoElements(Heap* heap,
   // fields.
   if (array_proto->elements() != heap->empty_fixed_array()) return false;
   // Object.prototype
-  Object* proto = array_proto->GetPrototype();
+  Object* proto = SAFE_GET_PROTOTYPE_FAST(array_proto);
   if (proto == heap->null_value()) return false;
   array_proto = JSObject::cast(proto);
   if (array_proto != native_context->initial_object_prototype()) return false;
   if (array_proto->elements() != heap->empty_fixed_array()) return false;
-  return array_proto->GetPrototype()->IsNull();
+  return SAFE_GET_PROTOTYPE_FAST(array_proto)->IsNull();
 }
 
 
@@ -331,7 +332,7 @@ static inline bool IsJSArrayFastElementMovingAllowed(Heap* heap,
   Context* native_context = heap->isolate()->context()->native_context();
   JSObject* array_proto =
       JSObject::cast(native_context->array_function()->prototype());
-  return receiver->GetPrototype() == array_proto &&
+  return SAFE_GET_PROTOTYPE_FAST(receiver) == array_proto &&
          ArrayPrototypeHasNoElements(heap, native_context, array_proto);
 }
 
@@ -1001,7 +1002,7 @@ BUILTIN(ArrayConcat) {
       Object* arg = args[i];
       if (!arg->IsJSArray() ||
           !JSArray::cast(arg)->HasFastElements() ||
-          JSArray::cast(arg)->GetPrototype() != array_proto) {
+          SAFE_GET_PROTOTYPE_FAST(JSArray::cast(arg)) != array_proto) {
         AllowHeapAllocation allow_allocation;
         return CallJsBuiltin(isolate, "ArrayConcatJS", args);
       }
@@ -1091,11 +1092,9 @@ BUILTIN(GeneratorPoisonPill) {
 static inline Object* FindHidden(Heap* heap,
                                  Object* object,
                                  FunctionTemplateInfo* type) {
-  if (type->IsTemplateFor(object)) return object;
-  Object* proto = object->GetPrototype(heap->isolate());
-  if (proto->IsJSObject() &&
-      JSObject::cast(proto)->map()->is_hidden_prototype()) {
-    return FindHidden(heap, proto, type);
+  for (PrototypeIterator<STORE_AS_POINTER, TYPE_BASED_WALK, END_AT_NON_HIDDEN>
+           iter(heap->isolate(), object); !iter.IsAtEnd(); iter.Advance()) {
+    if (type->IsTemplateFor(iter.GetCurrent())) return iter.GetCurrent();
   }
   return heap->null_value();
 }