For code like the following:

for (var key in obj) {
  if (!obj.hasOwnProperty(key)) { continue; }
  doSomethingWith(obj[key]);
}

We generate a megamorphic hasProp and a megamorphic getProp. In both cases, we can often do better. If, as is very likely, obj does not have any enumerable properties on its proto chain, then hasOwnProperty is always true. For the getProp, we can store information about how to access the most recent property in the iterator, and then use that instead of a megamorphic lookup.

V8 implemented this. It looks like it's one of the major differences between the number of megamorphic property accesses we generate in React-based benchmarks and the number generated in Chrome.

We should implement the same optimization.

I tried implementing the fusing of for..in + hasOwnProperty a few years ago in bug 1356315.

Instead of passing around ever-increasing numbers of arguments, it makes sense to wrap this up in a class.

Note that PropertyIndex can support own dense elethe indices optimization works on objects with dense elements, so long as they are not on the proto chain. We can't cache the iterator, but we can store indices for it.

Depends on D165206

This patch adds support for producing indices. Subsequent patches will store them in the NativeIterator and use them.

Depends on D165207

Drive-by cleanup

Depends on D165208

Depends on D165209

Prior to this patch, we would not attach an IC the first time we saw an object in a for-in loop, because we hadn't created a cached iterator yet. This makes writing testcases a bit awkward, and doesn't seem good for performance.

Depends on D165210

We use this in the next two patches to add optional fast-paths for hasProp and getProp when indices are available.

Depends on D165211

Depends on D165212

Depends on D165213

Depends on D165214

Depends on D165215

Without this change I saw intermittent failures with '--ion-check-range-analysis', because we inserted an extra use of an IteratorHasIndices and triggered an assertion during lowering.

Depends on D167107

https://hg.mozilla.org/mozilla-central/rev/80736413ee26
https://hg.mozilla.org/mozilla-central/rev/ce70716df32d
https://hg.mozilla.org/mozilla-central/rev/0d77465d31a9
https://hg.mozilla.org/mozilla-central/rev/284604572cda
https://hg.mozilla.org/mozilla-central/rev/5a34d12bfb67
https://hg.mozilla.org/mozilla-central/rev/3160865a976a
https://hg.mozilla.org/mozilla-central/rev/d967af0cdc3e
https://hg.mozilla.org/mozilla-central/rev/75be34e55f82
https://hg.mozilla.org/mozilla-central/rev/ffc5325948a6
https://hg.mozilla.org/mozilla-central/rev/9b54d7cd721e
https://hg.mozilla.org/mozilla-central/rev/4c6354f6ebf2
https://hg.mozilla.org/mozilla-central/rev/b4325f765972
https://hg.mozilla.org/mozilla-central/rev/f93a220d341c