[json] Use knowledge that all fast json properties are inobject

Change-Id: Ifd8734aa682e238de54284c74209d236c7ac824f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1622110Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61699}

src/json/json-parser.cc

@@ -612,7 +612,7 @@ Handle<Object> JsonParser<Char>::BuildJsonObject(
               *factory()->mutable_heap_number_map());
         }
       }
-      object->RawFastPropertyAtPut(index, value, mode);
+      object->RawFastInobjectPropertyAtPut(index, value, mode);
     }
     // Make all MutableHeapNumbers alive.
     if (!mutable_double_buffer.is_null()) {
@@ -1141,9 +1141,9 @@ JsonString JsonParser<Char>::ScanJsonString(bool needs_internalization) {
 
   while (true) {
     cursor_ = std::find_if(cursor_, end_, [&bits](Char c) {
-      if (sizeof(Char) == 2) {
+      if (sizeof(Char) == 2 && V8_UNLIKELY(c > unibrow::Latin1::kMaxChar)) {
         bits |= c;
-        if (c > unibrow::Latin1::kMaxChar) return false;
+        return false;
       }
       return MayTerminateJsonString(character_json_scan_flags[c]);
     });

src/objects/js-objects-inl.h

@@ -341,12 +341,18 @@ uint64_t JSObject::RawFastDoublePropertyAsBitsAt(FieldIndex index) {
   return ReadField<uint64_t>(index.offset());
 }
 
+void JSObject::RawFastInobjectPropertyAtPut(FieldIndex index, Object value,
+                                            WriteBarrierMode mode) {
+  DCHECK(index.is_inobject());
+  int offset = index.offset();
+  WRITE_FIELD(*this, offset, value);
+  CONDITIONAL_WRITE_BARRIER(*this, offset, value, mode);
+}
+
 void JSObject::RawFastPropertyAtPut(FieldIndex index, Object value,
                                     WriteBarrierMode mode) {
   if (index.is_inobject()) {
-    int offset = index.offset();
-    WRITE_FIELD(*this, offset, value);
-    CONDITIONAL_WRITE_BARRIER(*this, offset, value, mode);
+    RawFastInobjectPropertyAtPut(index, value, mode);
   } else {
     DCHECK_EQ(UPDATE_WRITE_BARRIER, mode);
     property_array()->set(index.outobject_array_index(), value);

src/objects/js-objects.h

@@ -640,6 +640,9 @@ class JSObject : public JSReceiver {
   inline void RawFastPropertyAtPut(
       FieldIndex index, Object value,
       WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  inline void RawFastInobjectPropertyAtPut(
+      FieldIndex index, Object value,
+      WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
   inline void RawFastDoublePropertyAsBitsAtPut(FieldIndex index, uint64_t bits);
   inline void WriteToField(int descriptor, PropertyDetails details,
                            Object value);