[crankshaft] Inline hasOwnProperty when used in fast-case for-in

e.g.,

for (var k in o) {
  if (!o.hasOwnProperty(k)) continue;
  ...
}

without enumerable properties on the prototype chain of o.

BUG=

Committed: https://crrev.com/dec80752eb344dfeb85588e61ac0afd22b11aadb
Cr-Commit-Position: refs/heads/master@{#34379}

Review URL: https://codereview.chromium.org/1742253002

Cr-Commit-Position: refs/heads/master@{#34405}

src/crankshaft/hydrogen.cc

@@ -8752,6 +8752,25 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
   }
   // Try to inline calls like Math.* as operations in the calling function.
   switch (id) {
+    case kObjectHasOwnProperty: {
+      // It's not safe to look through the phi for elements if we're compiling
+      // for osr.
+      if (top_info()->is_osr()) return false;
+      if (argument_count != 2) return false;
+      HValue* key = Top();
+      if (!key->IsLoadKeyed()) return false;
+      HValue* elements = HLoadKeyed::cast(key)->elements();
+      if (!elements->IsPhi() || elements->OperandCount() != 1) return false;
+      if (!elements->OperandAt(0)->IsForInCacheArray()) return false;
+      HForInCacheArray* cache = HForInCacheArray::cast(elements->OperandAt(0));
+      HValue* receiver = environment()->ExpressionStackAt(1);
+      if (!receiver->IsPhi() || receiver->OperandCount() != 1) return false;
+      if (cache->enumerable() != receiver->OperandAt(0)) return false;
+      Drop(3);  // key, receiver, function
+      Add<HCheckMapValue>(receiver, cache->map());
+      ast_context()->ReturnValue(graph()->GetConstantTrue());
+      return true;
+    }
     case kStringCharCodeAt:
     case kStringCharAt:
       if (argument_count == 2) {

src/objects.h

@@ -6564,6 +6564,7 @@ class Script: public Struct {
   V(Array.prototype, shift, ArrayShift)                     \
   V(Function.prototype, apply, FunctionApply)               \
   V(Function.prototype, call, FunctionCall)                 \
+  V(Object.prototype, hasOwnProperty, ObjectHasOwnProperty) \
   V(String.prototype, charCodeAt, StringCharCodeAt)         \
   V(String.prototype, charAt, StringCharAt)                 \
   V(String.prototype, concat, StringConcat)                 \