Always invoke C++ ArrayPush builtin.

src/bootstrapper.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 227 matching lines @@
   // 'from'.
   void TransferObject(Handle<JSObject> from, Handle<JSObject> to);
   void TransferNamedProperties(Handle<JSObject> from, Handle<JSObject> to);
   void TransferIndexedProperties(Handle<JSObject> from, Handle<JSObject> to);
 
   Handle<DescriptorArray> ComputeFunctionInstanceDescriptor(
       bool make_prototype_read_only,
       bool make_prototype_enumerable = false);
   void MakeFunctionInstancePrototypeWritable();
 
-  void AddSpecialFunction(Handle<JSObject> prototype,
-                          const char* name,
-                          Handle<Code> code);
+  Handle<JSFunction> MakeFunctionForBuiltin(Handle<String> name,
+                                            Handle<Code> code);
 
-  void BuildSpecialFunctionTable();
+  void OverrideWithSpecialFunction(Handle<JSObject> prototype,
+                                   const char* name,
+                                   Handle<Code> code);
+
+  void InstallSpecialFunctions();
 
   static bool CompileBuiltin(int index);
   static bool CompileNative(Vector<const char> name, Handle<String> source);
   static bool CompileScriptCached(Vector<const char> name,
                                   Handle<String> source,
                                   SourceCodeCache* cache,
                                   v8::Extension* extension,
                                   bool use_runtime_context);
 
   Handle<Context> result_;
@@ skipping 507 matching lines @@
     // Setup the call-as-constructor delegate.
     Handle<Code> code =
         Handle<Code>(Builtins::builtin(Builtins::HandleApiCallAsConstructor));
     Handle<JSFunction> delegate =
         Factory::NewFunction(Factory::empty_symbol(), JS_OBJECT_TYPE,
                              JSObject::kHeaderSize, code, true);
     global_context()->set_call_as_constructor_delegate(*delegate);
     delegate->shared()->DontAdaptArguments();
   }
 
-  global_context()->set_special_function_table(Heap::empty_fixed_array());
-
   // Initialize the out of memory slot.
   global_context()->set_out_of_memory(Heap::false_value());
 
   // Initialize the data slot.
   global_context()->set_data(Heap::undefined_value());
 }
 
 
 bool Genesis::CompileBuiltin(int index) {
   Vector<const char> name = Natives::GetScriptName(index);
@@ skipping 658 matching lines @@
   HandleScope scope;
 
   Handle<DescriptorArray> function_map_descriptors =
       ComputeFunctionInstanceDescriptor(false);
   Handle<Map> fm = Factory::CopyMapDropDescriptors(Top::function_map());
   fm->set_instance_descriptors(*function_map_descriptors);
   Top::context()->global_context()->set_function_map(*fm);
 }
 
 
-void Genesis::AddSpecialFunction(Handle<JSObject> prototype,
-                                 const char* name,
-                                 Handle<Code> code) {
-  Handle<String> key = Factory::LookupAsciiSymbol(name);
-  Handle<Object> value = Handle<Object>(prototype->GetProperty(*key));
-  if (value->IsJSFunction()) {
-    Handle<JSFunction> optimized = Factory::NewFunction(key,
-                                                        JS_OBJECT_TYPE,
-                                                        JSObject::kHeaderSize,
-                                                        code,
-                                                        false);
-    optimized->shared()->DontAdaptArguments();
-    int len = global_context()->special_function_table()->length();
-    Handle<FixedArray> new_array = Factory::NewFixedArray(len + 3);
-    for (int index = 0; index < len; index++) {
-      new_array->set(index,
-                     global_context()->special_function_table()->get(index));
-    }
-    new_array->set(len+0, *prototype);
-    new_array->set(len+1, *value);
-    new_array->set(len+2, *optimized);
-    global_context()->set_special_function_table(*new_array);
-  }
+Handle<JSFunction> Genesis::MakeFunctionForBuiltin(Handle<String> name,
+                                                   Handle<Code> code) {
+  Handle<JSFunction> optimized = Factory::NewFunction(name,
+                                                      JS_OBJECT_TYPE,
+                                                      JSObject::kHeaderSize,
+                                                      code,
+                                                      false);
+  optimized->shared()->DontAdaptArguments();
+  return optimized;
 }
 
 
-void Genesis::BuildSpecialFunctionTable() {
+void Genesis::OverrideWithSpecialFunction(Handle<JSObject> prototype,
+                                          const char* name,
+                                          Handle<Code> code) {
+  Handle<String> key = Factory::LookupAsciiSymbol(name);
+  Handle<Object> old_value = GetProperty(prototype, key);
+  // Check if the function is present in the first place.
+  // For example, FLAG_natives_file could affect if Array functions
+  // are installed at all.
+  if (!old_value->IsJSFunction()) return;
+  int old_length = Handle<JSFunction>::cast(old_value)->shared()->length();
+  Handle<JSFunction> optimized = MakeFunctionForBuiltin(key, code);
+  optimized->shared()->set_length(old_length);
+  SetProperty(prototype, key, optimized, NONE);
+}
+
+
+void Genesis::InstallSpecialFunctions() {
   HandleScope scope;
   Handle<JSObject> global = Handle<JSObject>(global_context()->global());
   // Add special versions for some Array.prototype functions.
   Handle<JSFunction> function =
       Handle<JSFunction>(
           JSFunction::cast(global->GetProperty(Heap::Array_symbol())));
   Handle<JSObject> visible_prototype =
       Handle<JSObject>(JSObject::cast(function->prototype()));
   // Remember to put those specializations on the hidden prototype if present.
   Handle<JSObject> special_prototype;
   Handle<Object> superproto(visible_prototype->GetPrototype());
   if (superproto->IsJSObject() &&
       JSObject::cast(*superproto)->map()->is_hidden_prototype()) {
     special_prototype = Handle<JSObject>::cast(superproto);
   } else {
     special_prototype = visible_prototype;
   }
-  AddSpecialFunction(special_prototype, "pop",
-                     Handle<Code>(Builtins::builtin(Builtins::ArrayPop)));
-  AddSpecialFunction(special_prototype, "push",
-                     Handle<Code>(Builtins::builtin(Builtins::ArrayPush)));
-  AddSpecialFunction(special_prototype, "shift",
-                     Handle<Code>(Builtins::builtin(Builtins::ArrayShift)));
-  AddSpecialFunction(special_prototype, "unshift",
-                     Handle<Code>(Builtins::builtin(Builtins::ArrayUnshift)));
-  AddSpecialFunction(special_prototype, "slice",
-                     Handle<Code>(Builtins::builtin(Builtins::ArraySlice)));
-  AddSpecialFunction(special_prototype, "splice",
-                     Handle<Code>(Builtins::builtin(Builtins::ArraySplice)));
+  OverrideWithSpecialFunction(
+      special_prototype, "pop",
+      Handle<Code>(Builtins::builtin(Builtins::ArrayPop)));
+  OverrideWithSpecialFunction(
+      special_prototype, "push",
+      Handle<Code>(Builtins::builtin(Builtins::ArrayPush)));
+  OverrideWithSpecialFunction(
+      special_prototype, "shift",
+      Handle<Code>(Builtins::builtin(Builtins::ArrayShift)));
+  OverrideWithSpecialFunction(
+      special_prototype, "unshift",
+      Handle<Code>(Builtins::builtin(Builtins::ArrayUnshift)));
+  OverrideWithSpecialFunction(
+      special_prototype, "slice",
+      Handle<Code>(Builtins::builtin(Builtins::ArraySlice)));
+  OverrideWithSpecialFunction(
+      special_prototype, "splice",
+      Handle<Code>(Builtins::builtin(Builtins::ArraySplice)));
 }
 
 
 Genesis::Genesis(Handle<Object> global_object,
                  v8::Handle<v8::ObjectTemplate> global_template,
                  v8::ExtensionConfiguration* extensions) {
   // Link this genesis object into the stacked genesis chain. This
   // must be done before any early exits because the destructor
   // will always do unlinking.
   previous_ = current_;
   current_  = this;
   result_ = Handle<Context>::null();
 
   // If V8 isn't running and cannot be initialized, just return.
   if (!V8::IsRunning() && !V8::Initialize(NULL)) return;
 
   // Before creating the roots we must save the context and restore it
   // on all function exits.
   HandleScope scope;
   SaveContext context;
 
   CreateRoots(global_template, global_object);
 
   if (!InstallNatives()) return;
 
   MakeFunctionInstancePrototypeWritable();
-  BuildSpecialFunctionTable();
+  InstallSpecialFunctions();
 
   if (!ConfigureGlobalObjects(global_template)) return;
 
   if (!InstallExtensions(extensions)) return;
 
   if (!InstallSpecialObjects()) return;
 
   result_ = global_context_;
 }
 
@@ skipping 38 matching lines @@
 }
 
 
 // Restore statics that are thread local.
 char* Genesis::RestoreState(char* from) {
   current_ = *reinterpret_cast<Genesis**>(from);
   return from + sizeof(current_);
 }
 
 } }  // namespace v8::internal