Don't use string slices when processing RexExp replace

src/string.js

-// Copyright 2006-2008 the V8 project authors. All rights reserved.
+// Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
 //       with the distribution.
@@ skipping 791 matching lines @@
     var elements = this.elements;
     elements[elements.length] = str;
   }
 }
 
 
 ReplaceResultBuilder.prototype.addSpecialSlice = function(start, end) {
   var len = end - start;
   if (len == 0) return;
   var elements = this.elements;
-  if (start >= 0 && len >= 0 && start < 0x80000 && len < 0x800) {
+  if (start < 0x80000 && len < 0x800) {
     elements[elements.length] = (start << 11) + len;
   } else {
-    elements[elements.length] = SubString(this.special_string, start, end);
+    // 0 < len <= String::kMaxLength and Smi::kMaxValue >= String::kMaxLength,
+    // so -len is a smi.
+    elements[elements.length] = -len;
+    elements[elements.length] = start;
   }
 }
 
 
 StringBuilder.prototype.generate = function() {
   return %StringBuilderConcat(this.elements, "");
 }
 
 
 ReplaceResultBuilder.prototype.generate = function() {
@@ skipping 55 matching lines @@
     "small", StringSmall,
     "strike", StringStrike,
     "sub", StringSub,
     "sup", StringSup,
     "toJSON", StringToJSON
   ));
 }
 
 
 SetupString();