Don't allocate handles for substrings when filling up the split result array.

src/runtime.cc

Index: src/runtime.cc
===================================================================
--- src/runtime.cc	(revision 8253)
+++ src/runtime.cc	(working copy)
@@ -5723,9 +5723,8 @@
 
 RUNTIME_FUNCTION(MaybeObject*, Runtime_StringSplit) {
   ASSERT(args.length() == 3);
-  HandleScope handle_scope(isolate);
-  CONVERT_ARG_CHECKED(String, subject, 0);
-  CONVERT_ARG_CHECKED(String, pattern, 1);
+  CONVERT_CHECKED(String, subject, args[0]);
+  CONVERT_CHECKED(String, pattern, args[1]);
   CONVERT_NUMBER_CHECKED(uint32_t, limit, Uint32, args[2]);
 
   int subject_length = subject->length();
@@ -5736,8 +5735,13 @@
   // isn't empty, we can never create more parts than ~half the length
   // of the subject.
 
-  if (!subject->IsFlat()) FlattenString(subject);
-
+  if (!subject->IsFlat()) {
+    Object* flat;
+    { MaybeObject* maybe_flat = subject->TryFlatten();
+      if (!maybe_flat->ToObject(&flat)) return maybe_flat;
+    }
+    subject = String::cast(flat);
+  }
   static const int kMaxInitialListCapacity = 16;
 
   ZoneScope scope(isolate, DELETE_ON_EXIT);
@@ -5745,7 +5749,13 @@
   // Find (up to limit) indices of separator and end-of-string in subject
   int initial_capacity = Min<uint32_t>(kMaxInitialListCapacity, limit);
   ZoneList<int> indices(initial_capacity);
-  if (!pattern->IsFlat()) FlattenString(pattern);
+  if (!pattern->IsFlat()) {
+    Object* flat;
+    { MaybeObject* maybe_flat = pattern->TryFlatten();
+      if (!maybe_flat->ToObject(&flat)) return maybe_flat;
+    }
+    pattern = String::cast(flat);
+  }
 
   // No allocation block.
   {
@@ -5791,29 +5801,36 @@
 
   // Create JSArray of substrings separated by separator.
   int part_count = indices.length();
+  Object* result;
+  { MaybeObject* maybe_result =
+      isolate->heap()->AllocateFixedArray(part_count);
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
+  FixedArray* elements = FixedArray::cast(result);
 
-  Handle<JSArray> result = isolate->factory()->NewJSArray(part_count);
-  result->set_length(Smi::FromInt(part_count));
-
-  ASSERT(result->HasFastElements());
-
   if (part_count == 1 && indices.at(0) == subject_length) {
-    FixedArray::cast(result->elements())->set(0, *subject);
-    return *result;
+    elements->set(0, subject);
+  } else {
+    int part_start = 0;
+    for (int i = 0; i < part_count; i++) {
+      int part_end = indices.at(i);
+      Object* result;
+      { MaybeObject* maybe_result =
+            isolate->heap()->AllocateSubString(subject, part_start, part_end);
+        if (!maybe_result->ToObject(&result)) return maybe_result;
+      }
+      elements->set(i, result);
+      part_start = part_end + pattern_length;
+    }
   }
-
-  Handle<FixedArray> elements(FixedArray::cast(result->elements()));
-  int part_start = 0;
-  for (int i = 0; i < part_count; i++) {
-    HandleScope local_loop_handle;
-    int part_end = indices.at(i);
-    Handle<String> substring =
-        isolate->factory()->NewSubString(subject, part_start, part_end);
-    elements->set(i, *substring);
-    part_start = part_end + pattern_length;
+  { MaybeObject* maybe_result = isolate->heap()->AllocateJSObject(
+        isolate->context()->global_context()->array_function());
+      if (!maybe_result->ToObject(&result)) return maybe_result;
   }
-
-  return *result;
+  JSArray* array = JSArray::cast(result);
+  array->SetContent(elements);
+  ASSERT(array->HasFastElements());
+  return array;
 }