Stop using plain Arrays internally in built-in functions.

src/v8natives.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 125 matching lines @@
   var global_is_detached = (global === global_receiver);
 
   if (!this_is_global_receiver || global_is_detached) {
     throw new $EvalError('The "this" object passed to eval must ' +
                          'be the global object from which eval originated');
   }
 
   var f = %CompileString(x);
   if (!IS_FUNCTION(f)) return f;
 
-  return f.call(this);
+  return %_CallFunction(this, f);
 }
 
 
 // execScript for IE compatibility.
 function GlobalExecScript(expr, lang) {
   // NOTE: We don't care about the character casing.
   if (!lang || /javascript/i.test(lang)) {
     var f = %CompileString(ToString(expr));
-    f.call(%GlobalReceiver(global));
+    %_CallFunction(%GlobalReceiver(global), f);
   }
   return null;
 }
 
 
 // ----------------------------------------------------------------------------
 
 
 function SetupGlobal() {
   // ECMA 262 - 15.1.1.1.
@@ skipping 997 matching lines @@
       if (%_IsConstructCall()) {
         // %NewObjectFromBound implicitly uses arguments passed to this
         // function. We do not pass the arguments object explicitly to avoid
         // materializing it and guarantee that this function will be optimized.
         return %NewObjectFromBound(fn, null);
       }
 
       return fn.apply(this_arg, arguments);
     };
   } else {
-    var bound_args = new $Array(argc_bound);
+    var bound_args = new InternalArray(argc_bound);
     for(var i = 0; i < argc_bound; i++) {
       bound_args[i] = %_Arguments(i+1);
     }
 
     var result = function() {
       // If this is a construct call we use a special runtime method
       // to generate the actual object using the bound function.
       if (%_IsConstructCall()) {
         // %NewObjectFromBound implicitly uses arguments passed to this
         // function. We do not pass the arguments object explicitly to avoid
         // materializing it and guarantee that this function will be optimized.
         return %NewObjectFromBound(fn, bound_args);
       }
 
       // Combine the args we got from the bind call with the args
       // given as argument to the invocation.
       var argc = %_ArgumentsLength();
-      var args = new $Array(argc + argc_bound);
+      var args = new InternalArray(argc + argc_bound);
       // Add bound arguments.
       for (var i = 0; i < argc_bound; i++) {
         args[i] = bound_args[i];
       }
       // Add arguments from call.
       for (var i = 0; i < argc; i++) {
         args[argc_bound + i] = %_Arguments(i);
       }
       return fn.apply(this_arg, args);
     };
@@ skipping 11 matching lines @@
   %FunctionSetLength(result, length);
 
   return result;
 }
 
 
 function NewFunction(arg1) {  // length == 1
   var n = %_ArgumentsLength();
   var p = '';
   if (n > 1) {
-    p = new $Array(n - 1);
+    p = new InternalArray(n - 1);
     for (var i = 0; i < n - 1; i++) p[i] = %_Arguments(i);
     p = Join(p, n - 1, ',', NonStringToString);
     // If the formal parameters string include ) - an illegal
     // character - it may make the combined function expression
     // compile. We avoid this problem by checking for this early on.
     if (p.indexOf(')') != -1) throw MakeSyntaxError('unable_to_parse',[]);
   }
   var body = (n > 0) ? ToString(%_Arguments(n - 1)) : '';
   var source = '(function(' + p + ') {\n' + body + '\n})';
 
   // The call to SetNewFunctionAttributes will ensure the prototype
   // property of the resulting function is enumerable (ECMA262, 15.3.5.2).
   var f = %CompileString(source)();
   %FunctionSetName(f, "anonymous");
   return %SetNewFunctionAttributes(f);
 }
 
 %SetCode($Function, NewFunction);
 
 // ----------------------------------------------------------------------------
 
 function SetupFunction() {
   InstallFunctions($Function.prototype, DONT_ENUM, $Array(
     "bind", FunctionBind,
     "toString", FunctionToString
   ));
 }
 
 SetupFunction();