Weaken the checks of IsFastJSArrayWithNoCustomIteration.

In the case where the array is a fast packed array, the CSA no longer needs
to check whether the prototype has elements. This only needed when the array
is holey.

This is a follow-up of CL #1183671.

Change-Id: I0087b827200995c741141f3183bf9a2c748d3b55
Reviewed-on: https://chromium-review.googlesource.com/1188315Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Hai Dang <dhai@google.com>
Cr-Commit-Position: refs/heads/master@{#55409}

src/builtins/builtins-iterator-gen.cc

@@ -201,10 +201,6 @@ TNode<JSArray> IteratorBuiltinsAssembler::IterableToList(
 
   TVARIABLE(JSArray, created_list);
 
-  // TODO(dhai): IsFastJSArrayWithNoCustomIteration unnecessarily checks that
-  // the prototype has no element even when the array is packed.
-  // Then the fast path will not be taken in the case when the array is packed
-  // and the prototype has some elements.
   Branch(IsFastJSArrayWithNoCustomIteration(iterable, context), &fast_path,
          &slow_path);
 

src/code-stub-assembler.cc

@@ -1068,8 +1068,7 @@ TNode<BoolT> CodeStubAssembler::IsFastJSArrayWithNoCustomIteration(
     TNode<Object> object, TNode<Context> context) {
   Label if_false(this, Label::kDeferred), if_fast(this), exit(this);
   TVARIABLE(BoolT, var_result);
-  GotoIfForceSlowPath(&if_false);
-  BranchIfFastJSArray(object, context, &if_fast, &if_false);
+  BranchIfFastJSArray(object, context, &if_fast, &if_false, true);
   BIND(&if_fast);
   {
     // Check that the Array.prototype hasn't been modified in a way that would
@@ -1091,7 +1090,8 @@ TNode<BoolT> CodeStubAssembler::IsFastJSArrayWithNoCustomIteration(
 }
 
 void CodeStubAssembler::BranchIfFastJSArray(Node* object, Node* context,
-                                            Label* if_true, Label* if_false) {
+                                            Label* if_true, Label* if_false,
+                                            bool iteration_only) {
   GotoIfForceSlowPath(if_false);
 
   // Bailout if receiver is a Smi.
@@ -1107,6 +1107,11 @@ void CodeStubAssembler::BranchIfFastJSArray(Node* object, Node* context,
   // Verify that our prototype is the initial array prototype.
   GotoIfNot(IsPrototypeInitialArrayPrototype(context, map), if_false);
 
+  if (iteration_only) {
+    // If we are only iterating over the array, there is no need to check
+    // the NoElements protector if the array is not holey.
+    GotoIfNot(IsHoleyFastElementsKind(elements_kind), if_true);
+  }
   Branch(IsNoElementsProtectorCellInvalid(), if_false, if_true);
 }
 

src/code-stub-assembler.h

@@ -754,7 +754,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   void BranchIfJSReceiver(Node* object, Label* if_true, Label* if_false);
 
   void BranchIfFastJSArray(Node* object, Node* context, Label* if_true,
-                           Label* if_false);
+                           Label* if_false, bool iteration_only = false);
   void BranchIfNotFastJSArray(Node* object, Node* context, Label* if_true,
                               Label* if_false) {
     BranchIfFastJSArray(object, context, if_false, if_true);