1 files changed, 31 insertions, 22 deletions

diff --git a/deps/v8/src/builtins/array-foreach.tq b/deps/v8/src/builtins/array-foreach.tq
index 9919f9e395..c0e19c0803 100644
--- a/deps/v8/src/builtins/array-foreach.tq
+++ b/deps/v8/src/builtins/array-foreach.tq
@@ -4,21 +4,21 @@
 
 module array {
   macro ArrayForEachTorqueContinuation(
-      context: Context, o: Object, len: Number, callbackfn: Callable,
+      context: Context, o: JSReceiver, len: Number, callbackfn: Callable,
       thisArg: Object, initial_k: Smi): Object {
     // 5. Let k be 0.
     // 6. Repeat, while k < len
     for (let k: Smi = initial_k; k < len; k = k + 1) {
       // 6a. Let Pk be ! ToString(k).
-      let pK: String = ToString_Inline(context, k);
+      const pK: String = ToString_Inline(context, k);
 
       // 6b. Let kPresent be ? HasProperty(O, Pk).
-      let kPresent: Oddball = HasPropertyObject(o, pK, context, kHasProperty);
+      const kPresent: Boolean = HasProperty(context, o, pK);
 
       // 6c. If kPresent is true, then
       if (kPresent == True) {
         // 6c. i. Let kValue be ? Get(O, Pk).
-        let kValue: Object = GetProperty(context, o, pK);
+        const kValue: Object = GetProperty(context, o, pK);
 
         // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
         Call(context, callbackfn, thisArg, kValue, k, o);
@@ -32,30 +32,39 @@ module array {
   javascript builtin ArrayForEachLoopEagerDeoptContinuation(
       context: Context, receiver: Object, callback: Object, thisArg: Object,
       initialK: Object, length: Object): Object {
+    // The unsafe cast is safe because all continuation points in forEach are
+    // after the ToObject(O) call that ensures we are dealing with a
+    // JSReceiver.
+    const jsreceiver: JSReceiver = unsafe_cast<JSReceiver>(receiver);
     return ArrayForEachLoopContinuation(
-        context, receiver, callback, thisArg, Undefined, receiver, initialK,
+        context, jsreceiver, callback, thisArg, Undefined, jsreceiver, initialK,
         length, Undefined);
   }
 
   javascript builtin ArrayForEachLoopLazyDeoptContinuation(
       context: Context, receiver: Object, callback: Object, thisArg: Object,
       initialK: Object, length: Object, result: Object): Object {
+    // The unsafe cast is safe because all continuation points in forEach are
+    // after the ToObject(O) call that ensures we are dealing with a
+    // JSReceiver.
+    const jsreceiver: JSReceiver = unsafe_cast<JSReceiver>(receiver);
     return ArrayForEachLoopContinuation(
-        context, receiver, callback, thisArg, Undefined, receiver, initialK,
+        context, jsreceiver, callback, thisArg, Undefined, jsreceiver, initialK,
         length, Undefined);
   }
 
   builtin ArrayForEachLoopContinuation(
-      context: Context, receiver: Object, callback: Object, thisArg: Object,
+      context: Context, receiver: JSReceiver, callback: Object, thisArg: Object,
       array: Object, object: Object, initialK: Object, length: Object,
       to: Object): Object {
     try {
-      let callbackfn: Callable = cast<Callable>(callback) otherwise Unexpected;
-      let k: Smi = cast<Smi>(initialK) otherwise Unexpected;
-      let number_length: Number = cast<Number>(length) otherwise Unexpected;
+      const callbackfn: Callable =
+          cast<Callable>(callback) otherwise Unexpected;
+      const k: Smi = cast<Smi>(initialK) otherwise Unexpected;
+      const number_length: Number = cast<Number>(length) otherwise Unexpected;
 
       return ArrayForEachTorqueContinuation(
-          context, object, number_length, callbackfn, thisArg, k);
+          context, receiver, number_length, callbackfn, thisArg, k);
     }
     label Unexpected {
       unreachable;
@@ -67,7 +76,7 @@ module array {
       thisArg: Object): void labels
   Bailout(Smi) {
     let k: Smi = 0;
-    let map: Map = a.map;
+    const map: Map = a.map;
 
     try {
       // Build a fast loop over the smi array.
@@ -78,7 +87,7 @@ module array {
         if (k >= a.length) goto Slow;
 
         try {
-          let value: Object =
+          const value: Object =
               LoadElementNoHole<FixedArrayType>(a, k) otherwise FoundHole;
           Call(context, callbackfn, thisArg, value, k, a);
         }
@@ -97,17 +106,17 @@ module array {
   }
 
   macro FastArrayForEach(
-      context: Context, o: Object, len: Number, callbackfn: Callable,
+      context: Context, o: JSReceiver, len: Number, callbackfn: Callable,
       thisArg: Object): Object labels
   Bailout(Smi) {
     let k: Smi = 0;
     try {
-      let smi_len: Smi = cast<Smi>(len) otherwise Slow;
-      let a: JSArray = cast<JSArray>(o) otherwise Slow;
-      let map: Map = a.map;
+      const smi_len: Smi = cast<Smi>(len) otherwise Slow;
+      const a: JSArray = cast<JSArray>(o) otherwise Slow;
+      const map: Map = a.map;
 
       if (!IsPrototypeInitialArrayPrototype(context, map)) goto Slow;
-      let elementsKind: ElementsKind = map.elements_kind;
+      const elementsKind: ElementsKind = map.elements_kind;
       if (!IsFastElementsKind(elementsKind)) goto Slow;
 
       if (IsElementsKindGreaterThan(elementsKind, HOLEY_ELEMENTS)) {
@@ -134,20 +143,20 @@ module array {
       }
 
       // 1. Let O be ? ToObject(this value).
-      let o: Object = ToObject(context, receiver);
+      const o: JSReceiver = ToObject_Inline(context, receiver);
 
       // 2. Let len be ? ToLength(? Get(O, "length")).
-      let len: Number = GetLengthProperty(context, o);
+      const len: Number = GetLengthProperty(context, o);
 
       // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
       if (arguments.length == 0) {
         goto TypeError;
       }
-      let callbackfn: Callable =
+      const callbackfn: Callable =
           cast<Callable>(arguments[0]) otherwise TypeError;
 
       // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      let thisArg: Object = arguments.length > 1 ? arguments[1] : Undefined;
+      const thisArg: Object = arguments.length > 1 ? arguments[1] : Undefined;
 
       // Special cases.
       let k: Smi = 0;