Avoid relying on monkey-patchable things in String.prototype.split.

src/string.js

Index: src/string.js
diff --git a/src/string.js b/src/string.js
index a04b23f7dbb0e54e1b9df385d275a27465e2220d..87b6dafb42d7cc1ce0454918daba97b6f2c6dc76 100644
--- a/src/string.js
+++ b/src/string.js
@@ -663,13 +663,13 @@ function StringSplitOnRegExp(subject, separator, limit, length) {
   while (true) {
 
     if (startIndex === length) {
-      result.push(%_SubString(subject, currentIndex, length));
+      result[result.length] = %_SubString(subject, currentIndex, length);

[Yang, 2013/06/19 10:30:43]

Wouldn't it be possible to install an indexed getter on Array.prototype to
intercept this?

       break;
     }
 
     var matchInfo = DoRegExpExec(separator, subject, startIndex);
     if (matchInfo == null || length === (startMatch = matchInfo[CAPTURE0])) {
-      result.push(%_SubString(subject, currentIndex, length));
+      result[result.length] = %_SubString(subject, currentIndex, length);
       break;
     }
     var endIndex = matchInfo[CAPTURE1];
@@ -680,7 +680,7 @@ function StringSplitOnRegExp(subject, separator, limit, length) {
       continue;
     }
 
-    result.push(%_SubString(subject, currentIndex, startMatch));
+    result[result.length] = %_SubString(subject, currentIndex, startMatch);
 
     if (result.length === limit) break;
 
@@ -689,9 +689,9 @@ function StringSplitOnRegExp(subject, separator, limit, length) {
       var start = matchInfo[i++];
       var end = matchInfo[i++];
       if (end != -1) {
-        result.push(%_SubString(subject, start, end));
+        result[result.length] = %_SubString(subject, start, end);
       } else {
-        result.push(void 0);
+        result[result.length] = void 0;
       }
       if (result.length === limit) break outer_loop;
     }