Medium size review.
LGTM. We could do the same for the strange array-with-two-extra-properties that is returned by RegExp.prototype.exec. http://codereview.chromium.org/1350003/diff/1/2 File src/bootstrapper.cc (right): http://codereview.chromium.org/1350003/diff/1/2#newcode765 src/bootstrapper.cc:765: 3); You already made a constant for this '3'. http://codereview.chromium.org/1350003/diff/1/3 File src/factory.h (right): http://codereview.chromium.org/1350003/diff/1/3#newcode44 src/factory.h:44: Inadvertent edit? http://codereview.chromium.org/1350003/diff/1/7 File src/runtime.cc (right): http://codereview.chromium.org/1350003/diff/1/7#newcode1263 src/runtime.cc:1263: // Map has changed, so use generic, but slower, method. This is a strange situation. Do we have a test of this? Does JSC set the same attributes on the properties in this case.
http://codereview.chromium.org/1350003/diff/1/2 File src/bootstrapper.cc (right): http://codereview.chromium.org/1350003/diff/1/2#newcode765 src/bootstrapper.cc:765: 3); Actually, not. This "3" is the enumeration index, not the field index. They just happen to be the same value. However, I'm not sure whether I need an index at all, since the value is not enumerable. I'll turn it into a counter. Easier to read that way, and the compiler should constant fold it anyway. http://codereview.chromium.org/1350003/diff/1/3 File src/factory.h (right): http://codereview.chromium.org/1350003/diff/1/3#newcode44 src/factory.h:44: Yes, removed. http://codereview.chromium.org/1350003/diff/1/7 File src/runtime.cc (right): http://codereview.chromium.org/1350003/diff/1/7#newcode1263 src/runtime.cc:1263: // Map has changed, so use generic, but slower, method. I guess the only way this can happen is when using RegExp.prototype.compile on a regexp that has been fiddeled with. I'll add a test of this case.