Use InternalArray during ObservedArraySplice to avoid page script interfering with self-hosted code

src/array.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 "use strict";
 
 // This file relies on the fact that the following declarations have been made
 // in runtime.js:
 // var $Array = global.Array;
 
@@ skipping 706 matching lines @@
   return del_count;
 }
 
 
 function ObservedArraySplice(start, delete_count) {
   var num_arguments = %_ArgumentsLength();
   var len = TO_UINT32(this.length);
   var start_i = ComputeSpliceStartIndex(TO_INTEGER(start), len);
   var del_count = ComputeSpliceDeleteCount(delete_count, num_arguments, len,
                                            start_i);
-  var deleted_elements = [];
-  deleted_elements.length = del_count;
+  var deleted_elements = new InternalArray(del_count);
   var num_elements_to_add = num_arguments > 2 ? num_arguments - 2 : 0;
 
   try {
     BeginPerformSplice(this);
 
     SimpleSlice(this, start_i, del_count, len, deleted_elements);
     SimpleMove(this, start_i, del_count, len, num_elements_to_add);
 
     // Insert the arguments into the resulting array in
     // place of the deleted elements.
     var i = start_i;
     var arguments_index = 2;
     var arguments_length = %_ArgumentsLength();
     while (arguments_index < arguments_length) {
       this[i++] = %_Arguments(arguments_index++);
     }
     this.length = len - del_count + num_elements_to_add;
 
   } finally {
     EndPerformSplice(this);
     if (deleted_elements.length || num_elements_to_add) {
-       EnqueueSpliceRecord(this,
-                           start_i,
-                           deleted_elements.slice(),
-                           num_elements_to_add);
+      var deleted_array = [];
+      %MoveArrayContents(deleted_elements, deleted_array);
+      EnqueueSpliceRecord(this, start_i, deleted_array, num_elements_to_add);
     }
   }
 
   // Return the deleted elements.
   return deleted_elements;
 }
 
 
 function ArraySplice(start, delete_count) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.splice");
 
   if (%IsObserved(this))
     return ObservedArraySplice.apply(this, arguments);
 
   var num_arguments = %_ArgumentsLength();
   var array = TO_OBJECT_INLINE(this);
   var len = TO_UINT32(array.length);
   var start_i = ComputeSpliceStartIndex(TO_INTEGER(start), len);
   var del_count = ComputeSpliceDeleteCount(delete_count, num_arguments, len,
                                            start_i);
   var deleted_elements = [];

[Toon Verwaest, 2014/06/02 09:31:15]

Now that you are fixing this above, can you also fix this here?

[rafaelw, 2014/06/02 20:32:56]

So I tried doing this, but array-natives-elements.js started failing in the
assertion that the elements kind of the returned array is fast smi.
InternalArray seems to be setup such that it's default elements storage is fast
holey elements.

On 2014/06/02 09:31:15, Toon Verwaest wrote:

   deleted_elements.length = del_count;
   var num_elements_to_add = num_arguments > 2 ? num_arguments - 2 : 0;
 
   if (del_count != num_elements_to_add && ObjectIsSealed(array)) {
     throw MakeTypeError("array_functions_change_sealed",
                         ["Array.prototype.splice"]);
   } else if (del_count > 0 && ObjectIsFrozen(array)) {
     throw MakeTypeError("array_functions_on_frozen",
                         ["Array.prototype.splice"]);
   }
@@ skipping 740 matching lines @@
   ));
 
   SetUpLockedPrototype(InternalPackedArray, $Array(), $Array(
     "join", getFunction("join", ArrayJoin),
     "pop", getFunction("pop", ArrayPop),
     "push", getFunction("push", ArrayPush)
   ));
 }
 
 SetUpArray();