Fix setting array length to be ES5 conform.

Fix setting array length to be ES5 conform.

This also refactors the way we set the length of an arrays' backing
store to use the new elements accessor interface. The actual fix is in
DictionaryElementsAccessor::SetLengthWithoutNormalize() where we first
search for non-deletable elements according to ES5 section 15.4.5.2
specifications.

Snippet from the specification: Attempting to set the length property of
an Array object to a value that is numerically less than or equal to the
largest numeric property name of an existing array indexed non-deletable
property of the array will result in the length being set to a numeric
value that is one greater than that largest numeric property name.

R=danno@chromium.org
TEST=test262/15.4.4.??-7-b-16

Committed: http://code.google.com/p/v8/source/detail?r=9911

[Michael Starzinger, 2011-11-02 14:17:32]

PTAL.

[danno, 2011-11-07 19:26:02]

lgtm if you address comments

http://codereview.chromium.org/8372064/diff/1/src/elements.cc
File src/elements.cc (right):

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode79
src/elements.cc:79: static Failure* ArrayLengthRangeError(Heap* heap) {
Call this ThrowArrayLengthRangeError

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode388
src/elements.cc:388: obj->GetElementsKind() == FAST_SMI_ONLY_ELEMENTS
Use obj->HasFastSmiOnlyElements()

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode549
src/elements.cc:549: { MaybeObject* maybe_obj = array->ResetElements();
This weird formatting is an artifact of an automated GC-related change that went
in a long time ago. Take this opportunity to remove the unneeded extra scope and
clean this up.

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode882
src/elements.cc:882: if (!maybe_object->To(&dictionary)) return maybe_object;
remove extra scope

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode899
src/elements.cc:899: { MaybeObject* maybe_obj =
array->GetHeap()->AllocateFixedArray(1);
prune extra scope

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode904
src/elements.cc:904: { MaybeObject* maybe_obj =
array->EnsureCanContainElements(&length, 1);
prune extra scope

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode909
src/elements.cc:909: array->set_elements(new_backing_store);
Consider using array->SetContent to simplify the previous several lines.

[Michael Starzinger, 2011-11-08 12:00:33]

Added new patch set. Rebased. Landed.

http://codereview.chromium.org/8372064/diff/1/src/elements.cc
File src/elements.cc (right):

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode79
src/elements.cc:79: static Failure* ArrayLengthRangeError(Heap* heap) {
On 2011/11/07 19:26:02, danno wrote:
> Call this ThrowArrayLengthRangeError

Done.

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode388
src/elements.cc:388: obj->GetElementsKind() == FAST_SMI_ONLY_ELEMENTS
On 2011/11/07 19:26:02, danno wrote:
> Use obj->HasFastSmiOnlyElements()

Done.

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode549
src/elements.cc:549: { MaybeObject* maybe_obj = array->ResetElements();
On 2011/11/07 19:26:02, danno wrote:
> This weird formatting is an artifact of an automated GC-related change that
went
> in a long time ago. Take this opportunity to remove the unneeded extra scope
and
> clean this up. 

Done.

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode882
src/elements.cc:882: if (!maybe_object->To(&dictionary)) return maybe_object;
On 2011/11/07 19:26:02, danno wrote:
> remove extra scope

Done.

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode899
src/elements.cc:899: { MaybeObject* maybe_obj =
array->GetHeap()->AllocateFixedArray(1);
On 2011/11/07 19:26:02, danno wrote:
> prune extra scope

Done.

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode904
src/elements.cc:904: { MaybeObject* maybe_obj =
array->EnsureCanContainElements(&length, 1);
On 2011/11/07 19:26:02, danno wrote:
> prune extra scope

Done.

http://codereview.chromium.org/8372064/diff/1/src/elements.cc#newcode909
src/elements.cc:909: array->set_elements(new_backing_store);
On 2011/11/07 19:26:02, danno wrote:
> Consider using array->SetContent to simplify the previous several lines.

Done.