Implement tracking and optimizations of packed arrays

src/elements.h

Index: src/elements.h
diff --git a/src/elements.h b/src/elements.h
index 51d402d34168e27167589261657cfa9812d01677..0e0b2a36d8d540380c6f7e51d12186d27f0437fe 100644
--- a/src/elements.h
+++ b/src/elements.h
@@ -28,6 +28,7 @@
 #ifndef V8_ELEMENTS_H_
 #define V8_ELEMENTS_H_
 
+#include "elements-kind.h"
 #include "objects.h"
 #include "heap.h"
 #include "isolate.h"
@@ -45,6 +46,10 @@ class ElementsAccessor {
   virtual ElementsKind kind() const = 0;
   const char* name() const { return name_; }
 
+  // Checks the elements of an object for consistency, asserting when a problem
+  // is found.
+  virtual void Validate(JSObject* obj) = 0;
+
   // Returns true if a holder contains an element with the specified key
   // without iterating up the prototype chain.  The caller can optionally pass
   // in the backing store to use for the check, which must be compatible with
@@ -79,9 +84,10 @@ class ElementsAccessor {
   // elements. This method should only be called for array expansion OR by
   // runtime JavaScript code that use InternalArrays and don't care about
   // EcmaScript 5.1 semantics.
-  virtual MaybeObject* SetCapacityAndLength(JSArray* array,
-                                            int capacity,
-                                            int length) = 0;
+  virtual MaybeObject* SetCapacityAndLength(

[Jakob Kummerow, 2012/05/13 21:55:27]

nit: why this formatting change?

[danno, 2012/05/22 11:05:21]

Done.

+      JSArray* array,
+      int capacity,
+      int length) = 0;
 
   // Deletes an element in an object, returning a new elements backing store.
   virtual MaybeObject* Delete(JSObject* holder,