Using array index hash code for string-to-number conversion.

test/mjsunit/fuzz-natives.js

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 158 matching lines @@
   // out-of-memory if the request is too large. In practice, the
   // size will be the number of captures of a RegExp.
   "RegExpConstructResult": true,
   "_RegExpConstructResult": true,
 
   // This function performs some checks compile time (it requires its first
   // argument to be a compile time smi).
   "_GetFromCache": true,
 
   // This function expects its first argument to be a non-smi.
-  "_IsStringWrapperSafeForDefaultValueOf" : true
+  "_IsStringWrapperSafeForDefaultValueOf" : true,
+
+  // Only applicable to strings.
+  "_HasCachedArrayIndex": true,
+  "_GetCachedArrayIndex": true
 };
 
 var currentlyUncallable = {
   // We need to find a way to test this without breaking the system.
   "SystemBreak": true
 };
 
 function testNatives() {
   var allNatives = %ListNatives();
   for (var i = 0; i < allNatives.length; i++) {
     var nativeInfo = allNatives[i];
     var name = nativeInfo[0];
     if (name in knownProblems || name in currentlyUncallable)
       continue;
     print(name);
     var argc = nativeInfo[1];
     testArgumentCount(name, argc);
     testArgumentTypes(name, argc);
   }
 }
 
 testNatives();