Optimize algorithm for String.prototype.repeat(), fix value caching in others

src/string.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file relies on the fact that the following declaration has been made
 // in runtime.js:
 // var $String = global.String;
 
 // -------------------------------------------------------------------
 
@@ skipping 693 matching lines @@
 
   return %_SubString(s, start_i, end_i);
 }
 
 
 // This is not a part of ECMA-262.
 function StringSubstr(start, n) {
   CHECK_OBJECT_COERCIBLE(this, "String.prototype.substr");
 
   var s = TO_STRING_INLINE(this);
+  var s_len = s.length;
   var len;
 
   // Correct n: If not given, set to string length; if explicitly
   // set to undefined, zero, or negative, returns empty string.
   if (IS_UNDEFINED(n)) {
-    len = s.length;
+    len = s_len;
   } else {
     len = TO_INTEGER(n);
     if (len <= 0) return '';
   }
 
   // Correct start: If not given (or undefined), set to zero; otherwise
   // convert to integer and handle negative case.
   if (IS_UNDEFINED(start)) {
     start = 0;
   } else {
     start = TO_INTEGER(start);
     // If positive, and greater than or equal to the string length,
     // return empty string.
-    if (start >= s.length) return '';
+    if (start >= s_len) return '';
     // If negative and absolute value is larger than the string length,
     // use zero.
     if (start < 0) {
-      start += s.length;
+      start += s_len;
       if (start < 0) start = 0;
     }
   }
 
   var end = start + len;
-  if (end > s.length) end = s.length;
+  if (end > s_len) end = s_len;
 
   return %_SubString(s, start, end);
 }
 
 
 // ECMA-262, 15.5.4.16
 function StringToLowerCaseJS() {
   CHECK_OBJECT_COERCIBLE(this, "String.prototype.toLowerCase");
 
   return %StringToLowerCase(TO_STRING_INLINE(this));
@@ skipping 200 matching lines @@
     "fixed", StringFixed,
     "italics", StringItalics,
     "small", StringSmall,
     "strike", StringStrike,
     "sub", StringSub,
     "sup", StringSup
   ));
 }
 
 SetUpString();