Stop using plain Arrays internally in built-in functions.

Stop using plain Arrays internally in built-in functions.

In built-in code we use arrays for internal computations.
This makes it possible to affect the built-in code by putting getters
or setters on the Array prototype chain.
This adds a new internal Array constructor that creates Arrays with
a very simplistic prototype chain that doesn't include any publicly
visible objects. These Arrays shoudl ofcourse never leak outside the
builtins, since that would expose the prototype object.
The prototype object contains only the array functions that we use:
push, pop and join (and not even a toString, so it doesn't stringify
well).

Also change uses of .call to %_CallFunction.

BUG=1206
Committed: http://code.google.com/p/v8/source/detail?r=7040

[Lasse Reichstein, 2011-03-02 12:01:04]

Hold for benchmark results.

[Mads Ager (chromium), 2011-03-03 10:33:21]

LGTM

We need a name that makes it more clear. Also, you should comment that you *have
to* use 'new' to get one of these constructed. I would prefer if we can find a
way to make sure that the 'new' keyword was not required.

http://codereview.chromium.org/6602081/diff/13/src/arm/builtins-arm.cc
File src/arm/builtins-arm.cc (right):

http://codereview.chromium.org/6602081/diff/13/src/arm/builtins-arm.cc#newcod...
src/arm/builtins-arm.cc:431: // Initial map for the builtin Array functions
shoud be maps.
shoud -> should

http://codereview.chromium.org/6602081/diff/13/src/array.js
File src/array.js (right):

http://codereview.chromium.org/6602081/diff/13/src/array.js#newcode1233
src/array.js:1233: // The internal Array prototype doesn't need to be fancy,
since it's never
I would like the difference to be more clear. $Array vs Array is subtle. Array
-> InternalArray or something like that.

http://codereview.chromium.org/6602081/diff/13/src/array.js#newcode1238
src/array.js:1238: Array.prototype = new $Object();
Do you need this one? Don't you already set this in the setup code for the
builtins object?

http://codereview.chromium.org/6602081/diff/13/src/bootstrapper.cc
File src/bootstrapper.cc (right):

http://codereview.chromium.org/6602081/diff/13/src/bootstrapper.cc#newcode1243
src/bootstrapper.cc:1243: {  // --- B u i l t - i n   A r r a y ---
Builtin -> Internal?

[Erik Corry, 2011-03-03 10:38:21]

How about a ToString that returns "Internal Array, length x"?

[Lasse Reichstein, 2011-03-03 12:28:21]

I'll try to find a way to prohibit non-constructor calls.

http://codereview.chromium.org/6602081/diff/13/src/arm/builtins-arm.cc
File src/arm/builtins-arm.cc (right):

http://codereview.chromium.org/6602081/diff/13/src/arm/builtins-arm.cc#newcod...
src/arm/builtins-arm.cc:431: // Initial map for the builtin Array functions
shoud be maps.
Fixed.

http://codereview.chromium.org/6602081/diff/13/src/array.js
File src/array.js (right):

http://codereview.chromium.org/6602081/diff/13/src/array.js#newcode1233
src/array.js:1233: // The internal Array prototype doesn't need to be fancy,
since it's never
Changing to InternalArray.

http://codereview.chromium.org/6602081/diff/13/src/array.js#newcode1238
src/array.js:1238: Array.prototype = new $Object();
True. Removing.