Optimize testing for an index's existence in packed Arrays

src/runtime.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This files contains runtime support implemented in JavaScript.
 
 // CAUTION: Some of the functions specified in this file are called
 // directly from compiled code. These are the functions with names in
 // ALL CAPS. The compiled code passes the first argument in 'this' and
 // it does not push the function onto the stack. This means that you
@@ skipping 306 matching lines @@
 function DELETE(key, strict) {
   return %DeleteProperty(%ToObject(this), %ToName(key), strict);
 }
 
 
 // ECMA-262, section 11.8.7, page 54.
 function IN(x) {
   if (!IS_SPEC_OBJECT(x)) {
     throw %MakeTypeError('invalid_in_operator_use', [this, x]);
   }
-  return %_IsNonNegativeSmi(this) ?
-    %HasElement(x, this) : %HasProperty(x, %ToName(this));
+  if (%_IsNonNegativeSmi(this)) {
+    if (IS_ARRAY(x) && %_HasFastPackedElements(x)) {
+      return this < x.length;
+    }
+    return %HasElement(x, this);
+  }
+  return %HasProperty(x, %ToName(this));
 }
 
 
 // ECMA-262, section 11.8.6, page 54. To make the implementation more
 // efficient, the return value should be zero if the 'this' is an
 // instance of F, and non-zero if not. This makes it possible to avoid
 // an expensive ToBoolean conversion in the generated code.
 function INSTANCE_OF(F) {
   var V = this;
   if (!IS_SPEC_FUNCTION(F)) {
@@ skipping 317 matching lines @@
   return i;
 }
 
 
 // NOTE: Setting the prototype for Array must take place as early as
 // possible due to code generation for array literals.  When
 // generating code for a array literal a boilerplate array is created
 // that is cloned when running the code.  It is essential that the
 // boilerplate gets the right prototype.
 %FunctionSetPrototype($Array, new $Array(0));