[builtins] Take fast path in Array.prototype.keys() only if length is an Smi

Do not take the fast path for Array.prototype.keys() if the array length is not
guaranteed to be an Smi.

BUG=660925, v8:5388
R=bmeurer@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2496323002
Cr-Commit-Position: refs/heads/master@{#40976}

src/code-stub-assembler.cc

@@ -8850,20 +8850,31 @@ compiler::Node* CodeStubAssembler::CreateArrayIterator(
     // There are only two key iterator maps, branch depending on whether or not
     // the receiver is a TypedArray or not.
 
-    Label if_isarray(this), if_istypedarray(this), if_isgeneric(this);
-    Label* kInstanceTypeHandlers[] = {&if_isarray, &if_istypedarray};
-
-    static int32_t kInstanceType[] = {JS_ARRAY_TYPE, JS_TYPED_ARRAY_TYPE};
+    Label if_istypedarray(this), if_isgeneric(this);
 
-    Switch(array_type, &if_isgeneric, kInstanceType, kInstanceTypeHandlers,
-           arraysize(kInstanceType));
+    Branch(Word32Equal(array_type, Int32Constant(JS_TYPED_ARRAY_TYPE)),
+           &if_istypedarray, &if_isgeneric);
 
-    Bind(&if_isarray);
+    Bind(&if_isgeneric);
     {
-      var_map_index.Bind(
-          IntPtrConstant(Context::FAST_ARRAY_KEY_ITERATOR_MAP_INDEX));
-      var_array_map.Bind(array_map);
-      Goto(&allocate_iterator);
+      Label if_isfast(this), if_isslow(this);
+      BranchIfFastJSArray(array, context, &if_isfast, &if_isslow);
+
+      Bind(&if_isfast);
+      {
+        var_map_index.Bind(
+            IntPtrConstant(Context::FAST_ARRAY_KEY_ITERATOR_MAP_INDEX));
+        var_array_map.Bind(array_map);
+        Goto(&allocate_iterator);
+      }
+
+      Bind(&if_isslow);
+      {
+        var_map_index.Bind(
+            IntPtrConstant(Context::GENERIC_ARRAY_KEY_ITERATOR_MAP_INDEX));
+        var_array_map.Bind(UndefinedConstant());
+        Goto(&allocate_iterator);
+      }
     }
 
     Bind(&if_istypedarray);
@@ -8873,14 +8884,6 @@ compiler::Node* CodeStubAssembler::CreateArrayIterator(
       var_array_map.Bind(UndefinedConstant());
       Goto(&allocate_iterator);
     }
-
-    Bind(&if_isgeneric);
-    {
-      var_map_index.Bind(
-          IntPtrConstant(Context::GENERIC_ARRAY_KEY_ITERATOR_MAP_INDEX));
-      var_array_map.Bind(UndefinedConstant());
-      Goto(&allocate_iterator);
-    }
   } else {
     Label if_istypedarray(this), if_isgeneric(this);
     Branch(Word32Equal(array_type, Int32Constant(JS_TYPED_ARRAY_TYPE)),

test/mjsunit/es6/regress/regress-660925.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let array = new Array(0xFFFFFFFF);
+let it = array.keys();
+assertEquals({ value: 0, done: false }, it.next());
+
+it = array.entries();
+assertEquals({ value: [0, undefined], done: false }, it.next());
+
+it = array[Symbol.iterator]();
+assertEquals({ value: undefined, done: false }, it.next());