Fast path for string.replace that replaces a single character by a string.

Fast path for string.replace that replaces a single character by a string.

BUG=
TEST=

Committed: http://code.google.com/p/v8/source/detail?r=10412

[Yang, 2012-01-13 16:36:57]

Please take a look.

When replacing a single character by a string, instead of flattening the string
for search and copying the string to replace, we can avoid flattening by
depth-first traversal of the cons-string tree and replace the affected part by a
cons string consisting of slices of the original string.

[rossberg, 2012-01-16 15:13:24]

lgtm

[Erik Corry, 2012-01-17 08:29:54]

Unfortunately this exhibits unbounded recursion.  Here's a way to crash it:


var s = "";
for (var i = 0; i < 100000; i++) {
  s = s + "y";
}

s.replace("x", "foo");