[builtins] Speedup Object.keys by adding a fast path for objects without...

[builtins] Speedup Object.keys by adding a fast path for objects without elements, interceptors, ...

This speeds up the for-of-object benchmark at
http://kpdecker.github.io/six-speed/ by >2x.

BUG=

Review URL: https://codereview.chromium.org/1682873003

Cr-Commit-Position: refs/heads/master@{#33867}

src/builtins.cc

@@ -1766,13 +1766,37 @@ BUILTIN(ObjectKeys) {
   Handle<JSReceiver> receiver;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, receiver,
                                      Object::ToObject(isolate, object));
+
   Handle<FixedArray> keys;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, keys, JSReceiver::GetKeys(receiver, OWN_ONLY, ENUMERABLE_STRINGS,
-                                         CONVERT_TO_STRING));
-  return *isolate->factory()->NewJSArrayWithElements(keys);
-}
+  int enum_length = receiver->map()->EnumLength();
+  if (enum_length != kInvalidEnumCacheSentinel) {
+    DCHECK(receiver->IsJSObject());
+    Handle<JSObject> js_object = Handle<JSObject>::cast(receiver);
+    DCHECK(!js_object->HasNamedInterceptor());
+    DCHECK(!js_object->IsAccessCheckNeeded());
+    DCHECK(!js_object->map()->has_hidden_prototype());
+    DCHECK(js_object->HasFastProperties());
+    if (js_object->elements() == isolate->heap()->empty_fixed_array()) {
+      keys = isolate->factory()->NewFixedArray(enum_length);
+      if (enum_length != 0) {
+        Handle<FixedArray> cache(
+            js_object->map()->instance_descriptors()->GetEnumCache());
+        keys = isolate->factory()->NewFixedArray(enum_length);
+        for (int i = 0; i < enum_length; i++) {
+          keys->set(i, cache->get(i));
+        }
+      }
+    }
+  }
 
+  if (keys.is_null()) {
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, keys,
+        JSReceiver::GetKeys(receiver, OWN_ONLY, ENUMERABLE_STRINGS,
+                            CONVERT_TO_STRING));
+  }
+  return *isolate->factory()->NewJSArrayWithElements(keys, FAST_ELEMENTS);
+}
 
 BUILTIN(ObjectValues) {
   HandleScope scope(isolate);

src/objects.cc

@@ -8742,7 +8742,8 @@ static Maybe<bool> GetKeysFromJSObject(Isolate* isolate,
     bool cache_enum_length =
         ((object->map()->GetConstructor() != *arguments_function) &&
          !object->IsJSValue() && !object->IsAccessCheckNeeded() &&
-         !object->HasNamedInterceptor() && !object->HasIndexedInterceptor());
+         !object->HasNamedInterceptor() && !object->HasIndexedInterceptor() &&
+         !object->map()->has_hidden_prototype());
     // Compute the property keys and cache them if possible.
     Handle<FixedArray> enum_keys =
         JSObject::GetEnumPropertyKeys(object, cache_enum_length);