Semi-weekly merge from bleeding_edge to the toiger branch.

src/runtime.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 951 matching lines @@
   return *target;
 }
 
 
 static Object* CharCodeAt(String* subject, Object* index) {
   uint32_t i = 0;
   if (!Array::IndexFromObject(index, &i)) return Heap::nan_value();
   // Flatten the string.  If someone wants to get a char at an index
   // in a cons string, it is likely that more indices will be
   // accessed.
-  subject->TryFlatten();
-  if (i >= static_cast<uint32_t>(subject->length())) return Heap::nan_value();
-  return Smi::FromInt(subject->Get(i));
+  StringShape shape(subject);
+  subject->TryFlatten(shape);  // shape no longer valid!
+  if (i >= static_cast<uint32_t>(subject->length(StringShape(subject)))) {
+    return Heap::nan_value();
+  }
+  return Smi::FromInt(subject->Get(StringShape(subject), i));
 }
 
 
 static Object* Runtime_StringCharCodeAt(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(String, subject, args[0]);
   Object* index = args[1];
   return CharCodeAt(subject, index);
@@ skipping 359 matching lines @@
   return BoyerMooreIndexOf(sub, pat, idx);
 }
 
 // Perform string match of pattern on subject, starting at start index.
 // Caller must ensure that 0 <= start_index <= sub->length(),
 // and should check that pat->length() + start_index <= sub->length()
 int Runtime::StringMatch(Handle<String> sub,
                          Handle<String> pat,
                          int start_index) {
   ASSERT(0 <= start_index);
-  ASSERT(start_index <= sub->length());
+  StringShape sub_shape(*sub);
+  StringShape pat_shape(*pat);
+  ASSERT(start_index <= sub->length(sub_shape));
 
-  int pattern_length = pat->length();
+  int pattern_length = pat->length(pat_shape);
   if (pattern_length == 0) return start_index;
 
-  int subject_length = sub->length();
+  int subject_length = sub->length(sub_shape);
   if (start_index + pattern_length > subject_length) return -1;
 
-  FlattenString(sub);
+  if (!sub->IsFlat(sub_shape)) {
+    FlattenString(sub);
+    sub_shape = StringShape(*sub);
+  }
   // Searching for one specific character is common.  For one
   // character patterns linear search is necessary, so any smart
   // algorithm is unnecessary overhead.
   if (pattern_length == 1) {
     AssertNoAllocation no_heap_allocation;  // ensure vectors stay valid
-    if (sub->is_ascii_representation()) {
-      return SingleCharIndexOf(sub->ToAsciiVector(), pat->Get(0), start_index);
+    if (sub_shape.IsAsciiRepresentation()) {
+      return SingleCharIndexOf(sub->ToAsciiVector(),
+                               pat->Get(pat_shape, 0),
+                               start_index);
     }
-    return SingleCharIndexOf(sub->ToUC16Vector(), pat->Get(0), start_index);
+    return SingleCharIndexOf(sub->ToUC16Vector(),
+                             pat->Get(pat_shape, 0),
+                             start_index);
   }
 
-  FlattenString(pat);
+  if (!pat->IsFlat(pat_shape)) {
+    FlattenString(pat);
+    pat_shape = StringShape(*pat);
+  }
 
   AssertNoAllocation no_heap_allocation;  // ensure vectors stay valid
   // dispatch on type of strings
-  if (pat->is_ascii_representation()) {
+  if (pat_shape.IsAsciiRepresentation()) {
     Vector<const char> pat_vector = pat->ToAsciiVector();
-    if (sub->is_ascii_representation()) {
+    if (sub_shape.IsAsciiRepresentation()) {
       return StringMatchStrategy(sub->ToAsciiVector(), pat_vector, start_index);
     }
     return StringMatchStrategy(sub->ToUC16Vector(), pat_vector, start_index);
   }
   Vector<const uc16> pat_vector = pat->ToUC16Vector();
-  if (sub->is_ascii_representation()) {
+  if (sub_shape.IsAsciiRepresentation()) {
     return StringMatchStrategy(sub->ToAsciiVector(), pat_vector, start_index);
   }
   return StringMatchStrategy(sub->ToUC16Vector(), pat_vector, start_index);
 }
 
 
 static Object* Runtime_StringIndexOf(Arguments args) {
   HandleScope scope;  // create a new handle scope
   ASSERT(args.length() == 3);
 
@@ skipping 11 matching lines @@
 
 
 static Object* Runtime_StringLastIndexOf(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 3);
 
   CONVERT_CHECKED(String, sub, args[0]);
   CONVERT_CHECKED(String, pat, args[1]);
   Object* index = args[2];
 
-  sub->TryFlatten();
-  pat->TryFlatten();
+  sub->TryFlatten(StringShape(sub));
+  pat->TryFlatten(StringShape(pat));
+
+  StringShape sub_shape(sub);
+  StringShape pat_shape(pat);
 
   uint32_t start_index;
   if (!Array::IndexFromObject(index, &start_index)) return Smi::FromInt(-1);
 
-  uint32_t pattern_length = pat->length();
-  uint32_t sub_length = sub->length();
+  uint32_t pattern_length = pat->length(pat_shape);
+  uint32_t sub_length = sub->length(sub_shape);
 
   if (start_index + pattern_length > sub_length) {
     start_index = sub_length - pattern_length;
   }
 
   for (int i = start_index; i >= 0; i--) {
     bool found = true;
     for (uint32_t j = 0; j < pattern_length; j++) {
-      if (sub->Get(i + j) != pat->Get(j)) {
+      if (sub->Get(sub_shape, i + j) != pat->Get(pat_shape, j)) {
         found = false;
         break;
       }
     }
     if (found) return Smi::FromInt(i);
   }
 
   return Smi::FromInt(-1);
 }
 
 
 static Object* Runtime_StringLocaleCompare(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(String, str1, args[0]);
   CONVERT_CHECKED(String, str2, args[1]);
 
   if (str1 == str2) return Smi::FromInt(0);  // Equal.
-  int str1_length = str1->length();
-  int str2_length = str2->length();
+  StringShape shape1(str1);
+  StringShape shape2(str2);
+  int str1_length = str1->length(shape1);
+  int str2_length = str2->length(shape2);
 
   // Decide trivial cases without flattening.
   if (str1_length == 0) {
     if (str2_length == 0) return Smi::FromInt(0);  // Equal.
     return Smi::FromInt(-str2_length);
   } else {
     if (str2_length == 0) return Smi::FromInt(str1_length);
   }
 
   int end = str1_length < str2_length ? str1_length : str2_length;
 
   // No need to flatten if we are going to find the answer on the first
   // character.  At this point we know there is at least one character
   // in each string, due to the trivial case handling above.
-  int d = str1->Get(0) - str2->Get(0);
+  int d = str1->Get(shape1, 0) - str2->Get(shape2, 0);
   if (d != 0) return Smi::FromInt(d);
 
-  str1->TryFlatten();
-  str2->TryFlatten();
+  str1->TryFlatten(shape1);  // Shapes are no longer valid now!
+  str2->TryFlatten(shape2);
 
   static StringInputBuffer buf1;
   static StringInputBuffer buf2;
 
   buf1.Reset(str1);
   buf2.Reset(str2);
 
   for (int i = 0; i < end; i++) {
     uint16_t char1 = buf1.GetNext();
     uint16_t char2 = buf2.GetNext();
     if (char1 != char2) return Smi::FromInt(char1 - char2);
   }
 
   return Smi::FromInt(str1_length - str2_length);
 }
 
 
 static Object* Runtime_StringSlice(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 3);
 
   CONVERT_CHECKED(String, value, args[0]);
   CONVERT_DOUBLE_CHECKED(from_number, args[1]);
   CONVERT_DOUBLE_CHECKED(to_number, args[2]);
 
   int start = FastD2I(from_number);
   int end = FastD2I(to_number);
 
+  StringShape shape(value);
+
   RUNTIME_ASSERT(end >= start);
   RUNTIME_ASSERT(start >= 0);
-  RUNTIME_ASSERT(end <= value->length());
-  return value->Slice(start, end);
+  RUNTIME_ASSERT(end <= value->length(shape));
+  return value->Slice(shape, start, end);
 }
 
 
 static Object* Runtime_NumberToRadixString(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_DOUBLE_CHECKED(value, args[0]);
   if (isnan(value)) {
     return Heap::AllocateStringFromAscii(CStrVector("NaN"));
@@ skipping 82 matching lines @@
   char* str = DoubleToPrecisionCString(value, f);
   Object* res = Heap::AllocateStringFromAscii(CStrVector(str));
   DeleteArray(str);
   return res;
 }
 
 
 // Returns a single character string where first character equals
 // string->Get(index).
 static Handle<Object> GetCharAt(Handle<String> string, uint32_t index) {
-  if (index < static_cast<uint32_t>(string->length())) {
-    string->TryFlatten();
-    return LookupSingleCharacterStringFromCode(string->Get(index));
+  StringShape shape(*string);
+  if (index < static_cast<uint32_t>(string->length(shape))) {
+    string->TryFlatten(shape);  // Invalidates shape!
+    return LookupSingleCharacterStringFromCode(
+        string->Get(StringShape(*string), index));
   }
   return Execution::CharAt(string, index);
 }
 
 
 Object* Runtime::GetElementOrCharAt(Handle<Object> object, uint32_t index) {
   // Handle [] indexing on Strings
   if (object->IsString()) {
     Handle<Object> result = GetCharAt(Handle<String>::cast(object), index);
     if (!result->IsUndefined()) return *result;
@@ skipping 164 matching lines @@
     return *value;
   }
 
   if (key->IsString()) {
     Handle<Object> result;
     if (Handle<String>::cast(key)->AsArrayIndex(&index)) {
       ASSERT(attr == NONE);
       result = SetElement(js_object, index, value);
     } else {
       Handle<String> key_string = Handle<String>::cast(key);
-      key_string->TryFlatten();
+      key_string->TryFlatten(StringShape(*key_string));
       result = SetProperty(js_object, key_string, value, attr);
     }
     if (result.is_null()) return Failure::Exception();
     return *value;
   }
 
   // Call-back into JavaScript to convert the key to a string.
   bool has_pending_exception = false;
   Handle<Object> converted = Execution::ToString(key, &has_pending_exception);
   if (has_pending_exception) return Failure::Exception();
@@ skipping 70 matching lines @@
 
   // Only JS objects can have properties.
   if (args[0]->IsJSObject()) {
     JSObject* object = JSObject::cast(args[0]);
     if (object->HasLocalProperty(key)) return Heap::true_value();
   } else if (args[0]->IsString()) {
     // Well, there is one exception:  Handle [] on strings.
     uint32_t index;
     if (key->AsArrayIndex(&index)) {
       String* string = String::cast(args[0]);
-      if (index < static_cast<uint32_t>(string->length()))
+      StringShape shape(string);
+      if (index < static_cast<uint32_t>(string->length(shape)))
         return Heap::true_value();
     }
   }
   return Heap::false_value();
 }
 
 
 static Object* Runtime_HasProperty(Arguments args) {
   NoHandleAllocation na;
   ASSERT(args.length() == 2);
@@ skipping 28 matching lines @@
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(JSObject, object, args[0]);
   CONVERT_CHECKED(String, key, args[1]);
 
   uint32_t index;
   if (key->AsArrayIndex(&index)) {
     return Heap::ToBoolean(object->HasElement(index));
   }
 
-  LookupResult result;
-  object->LocalLookup(key, &result);
-  if (!result.IsProperty()) return Heap::false_value();
-  return Heap::ToBoolean(!result.IsDontEnum());
+  PropertyAttributes att = object->GetLocalPropertyAttribute(key);
+  return Heap::ToBoolean(att != ABSENT && (att & DONT_ENUM) == 0);
 }
 
 
 static Object* Runtime_GetPropertyNames(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSObject, raw_object, args[0]);
   Handle<JSObject> object(raw_object);
   return *GetKeysFor(object);
@@ skipping 110 matching lines @@
       // host objects gives that it is okay to return "object"
       return Heap::object_symbol();
   }
 }
 
 
 static Object* Runtime_StringToNumber(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(String, subject, args[0]);
-  subject->TryFlatten();
+  subject->TryFlatten(StringShape(subject));
   return Heap::NumberFromDouble(StringToDouble(subject, ALLOW_HEX));
 }
 
 
 static Object* Runtime_StringFromCharCodeArray(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSArray, codes, args[0]);
   int length = Smi::cast(codes->length())->value();
 
   // Check if the string can be ASCII.
   int i;
   for (i = 0; i < length; i++) {
     Object* element = codes->GetElement(i);
     CONVERT_NUMBER_CHECKED(int, chr, Int32, element);
     if ((chr & 0xffff) > String::kMaxAsciiCharCode)
       break;
   }
 
   Object* object = NULL;
   if (i == length) {  // The string is ASCII.
     object = Heap::AllocateRawAsciiString(length);
   } else {  // The string is not ASCII.
     object = Heap::AllocateRawTwoByteString(length);
   }
 
   if (object->IsFailure()) return object;
   String* result = String::cast(object);
+  StringShape result_shape(result);
   for (int i = 0; i < length; i++) {
     Object* element = codes->GetElement(i);
     CONVERT_NUMBER_CHECKED(int, chr, Int32, element);
-    result->Set(i, chr & 0xffff);
+    result->Set(result_shape, i, chr & 0xffff);
   }
   return result;
 }
 
 
 // kNotEscaped is generated by the following:
 //
 // #!/bin/perl
 // for (my $i = 0; $i < 256; $i++) {
 //   print "\n" if $i % 16 == 0;
@@ skipping 28 matching lines @@
   return kNotEscaped[character] != 0;
 }
 
 
 static Object* Runtime_URIEscape(Arguments args) {
   const char hex_chars[] = "0123456789ABCDEF";
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(String, source, args[0]);
 
-  source->TryFlatten();
+  source->TryFlatten(StringShape(source));
 
   int escaped_length = 0;
   int length = source->length();
   {
     Access<StringInputBuffer> buffer(&string_input_buffer);
     buffer->Reset(source);
     while (buffer->has_more()) {
       uint16_t character = buffer->GetNext();
       if (character >= 256) {
         escaped_length += 6;
       } else if (IsNotEscaped(character)) {
         escaped_length++;
       } else {
         escaped_length += 3;
       }
       // We don't allow strings that are longer than Smi range.
       if (!Smi::IsValid(escaped_length)) {
         Top::context()->mark_out_of_memory();
         return Failure::OutOfMemoryException();
       }
     }
   }
   // No length change implies no change.  Return original string if no change.
   if (escaped_length == length) {
     return source;
   }
   Object* o = Heap::AllocateRawAsciiString(escaped_length);
   if (o->IsFailure()) return o;
   String* destination = String::cast(o);
+  StringShape dshape(destination);
   int dest_position = 0;
 
   Access<StringInputBuffer> buffer(&string_input_buffer);
   buffer->Rewind();
   while (buffer->has_more()) {
-    uint16_t character = buffer->GetNext();
-    if (character >= 256) {
-      destination->Set(dest_position, '%');
-      destination->Set(dest_position+1, 'u');
-      destination->Set(dest_position+2, hex_chars[character >> 12]);
-      destination->Set(dest_position+3, hex_chars[(character >> 8) & 0xf]);
-      destination->Set(dest_position+4, hex_chars[(character >> 4) & 0xf]);
-      destination->Set(dest_position+5, hex_chars[character & 0xf]);
+    uint16_t chr = buffer->GetNext();
+    if (chr >= 256) {
+      destination->Set(dshape, dest_position, '%');
+      destination->Set(dshape, dest_position+1, 'u');
+      destination->Set(dshape, dest_position+2, hex_chars[chr >> 12]);
+      destination->Set(dshape, dest_position+3, hex_chars[(chr >> 8) & 0xf]);
+      destination->Set(dshape, dest_position+4, hex_chars[(chr >> 4) & 0xf]);
+      destination->Set(dshape, dest_position+5, hex_chars[chr & 0xf]);
       dest_position += 6;
-    } else if (IsNotEscaped(character)) {
-      destination->Set(dest_position, character);
+    } else if (IsNotEscaped(chr)) {
+      destination->Set(dshape, dest_position, chr);
       dest_position++;
     } else {
-      destination->Set(dest_position, '%');
-      destination->Set(dest_position+1, hex_chars[character >> 4]);
-      destination->Set(dest_position+2, hex_chars[character & 0xf]);
+      destination->Set(dshape, dest_position, '%');
+      destination->Set(dshape, dest_position+1, hex_chars[chr >> 4]);
+      destination->Set(dshape, dest_position+2, hex_chars[chr & 0xf]);
       dest_position += 3;
     }
   }
   return destination;
 }
 
 
 static inline int TwoDigitHex(uint16_t character1, uint16_t character2) {
   static const signed char kHexValue['g'] = {
     -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
     -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
     -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
     0,  1,  2,   3,  4,  5,  6,  7,  8,  9, -1, -1, -1, -1, -1, -1,
     -1, 10, 11, 12, 13, 14, 15, -1, -1, -1, -1, -1, -1, -1, -1, -1,
     -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
     -1, 10, 11, 12, 13, 14, 15 };
 
   if (character1 > 'f') return -1;
   int hi = kHexValue[character1];
   if (hi == -1) return -1;
   if (character2 > 'f') return -1;
   int lo = kHexValue[character2];
   if (lo == -1) return -1;
   return (hi << 4) + lo;
 }
 
 
-static inline int Unescape(String* source, int i, int length, int* step) {
-  uint16_t character = source->Get(i);
-  int32_t hi, lo;
+static inline int Unescape(String* source,
+                           StringShape shape,
+                           int i,
+                           int length,
+                           int* step) {
+  uint16_t character = source->Get(shape, i);
+  int32_t hi = 0;
+  int32_t lo = 0;
   if (character == '%' &&
       i <= length - 6 &&
-      source->Get(i + 1) == 'u' &&
-      (hi = TwoDigitHex(source->Get(i + 2), source->Get(i + 3))) != -1 &&
-      (lo = TwoDigitHex(source->Get(i + 4), source->Get(i + 5))) != -1) {
+      source->Get(shape, i + 1) == 'u' &&
+      (hi = TwoDigitHex(source->Get(shape, i + 2),
+                        source->Get(shape, i + 3))) != -1 &&
+      (lo = TwoDigitHex(source->Get(shape, i + 4),
+                        source->Get(shape, i + 5))) != -1) {
     *step = 6;
     return (hi << 8) + lo;
   } else if (character == '%' &&
       i <= length - 3 &&
-      (lo = TwoDigitHex(source->Get(i + 1), source->Get(i + 2))) != -1) {
+      (lo = TwoDigitHex(source->Get(shape, i + 1),
+                        source->Get(shape, i + 2))) != -1) {
     *step = 3;
     return lo;
   } else {
     *step = 1;
     return character;
   }
 }
 
 
 static Object* Runtime_URIUnescape(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(String, source, args[0]);
 
-  source->TryFlatten();
+  source->TryFlatten(StringShape(source));
+  StringShape source_shape(source);
 
   bool ascii = true;
-  int length = source->length();
+  int length = source->length(source_shape);
 
   int unescaped_length = 0;
   for (int i = 0; i < length; unescaped_length++) {
     int step;
-    if (Unescape(source, i, length, &step) > String::kMaxAsciiCharCode)
+    if (Unescape(source,
+                 source_shape,
+                 i,
+                 length,
+                 &step) >
+        String::kMaxAsciiCharCode)
       ascii = false;
     i += step;
   }
 
   // No length change implies no change.  Return original string if no change.
   if (unescaped_length == length)
     return source;
 
   Object* o = ascii ?
               Heap::AllocateRawAsciiString(unescaped_length) :
               Heap::AllocateRawTwoByteString(unescaped_length);
   if (o->IsFailure()) return o;
   String* destination = String::cast(o);
+  StringShape destination_shape(destination);
 
   int dest_position = 0;
   for (int i = 0; i < length; dest_position++) {
     int step;
-    destination->Set(dest_position, Unescape(source, i, length, &step));
+    destination->Set(destination_shape,
+                     dest_position,
+                     Unescape(source, source_shape, i, length, &step));
     i += step;
   }
   return destination;
 }
 
 
 static Object* Runtime_StringParseInt(Arguments args) {
   NoHandleAllocation ha;
 
   CONVERT_CHECKED(String, s, args[0]);
   CONVERT_DOUBLE_CHECKED(n, args[1]);
   int radix = FastD2I(n);
 
-  s->TryFlatten();
+  s->TryFlatten(StringShape(s));
 
-  int len = s->length();
+  StringShape shape(s);
+
+  int len = s->length(shape);
   int i;
 
   // Skip leading white space.
-  for (i = 0; i < len && Scanner::kIsWhiteSpace.get(s->Get(i)); i++) ;
+  for (i = 0; i < len && Scanner::kIsWhiteSpace.get(s->Get(shape, i)); i++) ;
   if (i == len) return Heap::nan_value();
 
   // Compute the sign (default to +).
   int sign = 1;
-  if (s->Get(i) == '-') {
+  if (s->Get(shape, i) == '-') {
     sign = -1;
     i++;
-  } else if (s->Get(i) == '+') {
+  } else if (s->Get(shape, i) == '+') {
     i++;
   }
 
   // Compute the radix if 0.
   if (radix == 0) {
     radix = 10;
-    if (i < len && s->Get(i) == '0') {
+    if (i < len && s->Get(shape, i) == '0') {
       radix = 8;
       if (i + 1 < len) {
-        int c = s->Get(i + 1);
+        int c = s->Get(shape, i + 1);
         if (c == 'x' || c == 'X') {
           radix = 16;
           i += 2;
         }
       }
     }
   } else if (radix == 16) {
     // Allow 0x or 0X prefix if radix is 16.
-    if (i + 1 < len && s->Get(i) == '0') {
-      int c = s->Get(i + 1);
+    if (i + 1 < len && s->Get(shape, i) == '0') {
+      int c = s->Get(shape, i + 1);
       if (c == 'x' || c == 'X') i += 2;
     }
   }
 
   RUNTIME_ASSERT(2 <= radix && radix <= 36);
   double value;
   int end_index = StringToInt(s, i, radix, &value);
   if (end_index != i) {
     return Heap::NumberFromDouble(sign * value);
   }
@@ skipping 16 matching lines @@
 static unibrow::Mapping<unibrow::ToUppercase, 128> to_upper_mapping;
 static unibrow::Mapping<unibrow::ToLowercase, 128> to_lower_mapping;
 
 
 template <class Converter>
 static Object* ConvertCase(Arguments args,
                            unibrow::Mapping<Converter, 128>* mapping) {
   NoHandleAllocation ha;
 
   CONVERT_CHECKED(String, s, args[0]);
-  int raw_string_length = s->length();
+  s->TryFlatten(StringShape(s));
+  StringShape shape(s);
+
+  int raw_string_length = s->length(shape);
   // Assume that the string is not empty; we need this assumption later
   if (raw_string_length == 0) return s;
   int length = raw_string_length;
 
-  s->TryFlatten();
 
   // We try this twice, once with the assumption that the result is
   // no longer than the input and, if that assumption breaks, again
   // with the exact length.  This is implemented using a goto back
   // to this label if we discover that the assumption doesn't hold.
   // I apologize sincerely for this and will give a vaffel-is to
   // the first person who can implement it in a nicer way.
  try_convert:
 
   // Allocate the resulting string.
   //
   // NOTE: This assumes that the upper/lower case of an ascii
   // character is also ascii.  This is currently the case, but it
   // might break in the future if we implement more context and locale
   // dependent upper/lower conversions.
-  Object* o = s->IsAsciiRepresentation()
+  Object* o = shape.IsAsciiRepresentation()
       ? Heap::AllocateRawAsciiString(length)
       : Heap::AllocateRawTwoByteString(length);
   if (o->IsFailure()) return o;
   String* result = String::cast(o);
+  StringShape result_shape(result);
   bool has_changed_character = false;
 
   // Convert all characters to upper case, assuming that they will fit
   // in the buffer
   Access<StringInputBuffer> buffer(&string_input_buffer);
   buffer->Reset(s);
   unibrow::uchar chars[unibrow::kMaxCaseConvertedSize];
   int i = 0;
   // We can assume that the string is not empty
   uc32 current = buffer->GetNext();
   while (i < length) {
     bool has_next = buffer->has_more();
     uc32 next = has_next ? buffer->GetNext() : 0;
     int char_length = mapping->get(current, next, chars);
     if (char_length == 0) {
       // The case conversion of this character is the character itself.
-      result->Set(i, current);
+      result->Set(result_shape, i, current);
       i++;
     } else if (char_length == 1) {
       // Common case: converting the letter resulted in one character.
       ASSERT(static_cast<uc32>(chars[0]) != current);
-      result->Set(i, chars[0]);
+      result->Set(result_shape, i, chars[0]);
       has_changed_character = true;
       i++;
     } else if (length == raw_string_length) {
       // We've assumed that the result would be as long as the
       // input but here is a character that converts to several
       // characters.  No matter, we calculate the exact length
       // of the result and try the whole thing again.
       //
       // Note that this leaves room for optimization.  We could just
       // memcpy what we already have to the result string.  Also,
@@ skipping 14 matching lines @@
         // it does not in any case affect the length of what it convert
         // to.
         int char_length = mapping->get(current, 0, chars);
         if (char_length == 0) char_length = 1;
         current_length += char_length;
       }
       length = current_length;
       goto try_convert;
     } else {
       for (int j = 0; j < char_length; j++) {
-        result->Set(i, chars[j]);
+        result->Set(result_shape, i, chars[j]);
         i++;
       }
       has_changed_character = true;
     }
     current = next;
   }
   if (has_changed_character) {
     return result;
   } else {
     // If we didn't actually change anything in doing the conversion
     // we simple return the result and let the converted string
     // become garbage; there is no reason to keep two identical strings
     // alive.
     return s;
   }
 }
 
 
 static Object* Runtime_StringToLowerCase(Arguments args) {
   return ConvertCase<unibrow::ToLowercase>(args, &to_lower_mapping);
 }
 
 
 static Object* Runtime_StringToUpperCase(Arguments args) {
   return ConvertCase<unibrow::ToUppercase>(args, &to_upper_mapping);
 }
 
 
-static Object* Runtime_ConsStringFst(Arguments args) {
-  NoHandleAllocation ha;
-
-  CONVERT_CHECKED(ConsString, str, args[0]);
-  return str->first();
-}
-
-
-static Object* Runtime_ConsStringSnd(Arguments args) {
-  NoHandleAllocation ha;
-
-  CONVERT_CHECKED(ConsString, str, args[0]);
-  return str->second();
-}
-
-
 static Object* Runtime_NumberToString(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   Object* number = args[0];
   RUNTIME_ASSERT(number->IsNumber());
 
   Object* cached = Heap::GetNumberStringCache(number);
   if (cached != Heap::undefined_value()) {
     return cached;
@@ skipping 44 matching lines @@
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   Object* obj = args[0];
   if (obj->IsSmi()) return obj;
   CONVERT_DOUBLE_CHECKED(number, obj);
   return Heap::NumberFromInt32(DoubleToInt32(number));
 }
 
 
+// Converts a Number to a Smi, if possible. Returns NaN if the number is not
+// a small integer.
+static Object* Runtime_NumberToSmi(Arguments args) {
+  NoHandleAllocation ha;
+  ASSERT(args.length() == 1);
+
+  Object* obj = args[0];
+  if (obj->IsSmi()) {
+    return obj;
+  }
+  if (obj->IsHeapNumber()) {
+    double value = HeapNumber::cast(obj)->value();
+    int int_value = FastD2I(value);
+    if (value == FastI2D(int_value) && Smi::IsValid(int_value)) {
+      return Smi::FromInt(int_value);
+    }
+  }
+  return Heap::nan_value();
+}
+
 static Object* Runtime_NumberAdd(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   CONVERT_DOUBLE_CHECKED(y, args[1]);
   return Heap::AllocateHeapNumber(x + y);
 }
 
 
@@ skipping 55 matching lines @@
   return Heap::NewNumberFromDouble(x);
 }
 
 
 static Object* Runtime_StringAdd(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(String, str1, args[0]);
   CONVERT_CHECKED(String, str2, args[1]);
-  int len1 = str1->length();
-  int len2 = str2->length();
+  StringShape shape1(str1);
+  StringShape shape2(str2);
+  int len1 = str1->length(shape1);
+  int len2 = str2->length(shape2);
   if (len1 == 0) return str2;
   if (len2 == 0) return str1;
   int length_sum = len1 + len2;
   // Make sure that an out of memory exception is thrown if the length
   // of the new cons string is too large to fit in a Smi.
   if (length_sum > Smi::kMaxValue || length_sum < 0) {
     Top::context()->mark_out_of_memory();
     return Failure::OutOfMemoryException();
   }
-  return Heap::AllocateConsString(str1, str2);
+  return Heap::AllocateConsString(str1, shape1, str2, shape2);
 }
 
 
 template<typename sinkchar>
 static inline void StringBuilderConcatHelper(String* special,
+                                             StringShape special_shape,
                                              sinkchar* sink,
                                              FixedArray* fixed_array,
                                              int array_length) {
   int position = 0;
   for (int i = 0; i < array_length; i++) {
     Object* element = fixed_array->get(i);
     if (element->IsSmi()) {
       int len = Smi::cast(element)->value();
       int pos = len >> 11;
       len &= 0x7ff;
-      String::WriteToFlat(special, sink + position, pos, pos + len);
+      String::WriteToFlat(special,
+                          special_shape,
+                          sink + position,
+                          pos,
+                          pos + len);
       position += len;
     } else {
       String* string = String::cast(element);
-      int element_length = string->length();
-      String::WriteToFlat(string, sink + position, 0, element_length);
+      StringShape shape(string);
+      int element_length = string->length(shape);
+      String::WriteToFlat(string, shape, sink + position, 0, element_length);
       position += element_length;
     }
   }
 }
 
 
 static Object* Runtime_StringBuilderConcat(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
   CONVERT_CHECKED(JSArray, array, args[0]);
   CONVERT_CHECKED(String, special, args[1]);
-  int special_length = special->length();
+  StringShape special_shape(special);
+  int special_length = special->length(special_shape);
   Object* smi_array_length = array->length();
   if (!smi_array_length->IsSmi()) {
     Top::context()->mark_out_of_memory();
     return Failure::OutOfMemoryException();
   }
   int array_length = Smi::cast(smi_array_length)->value();
   if (!array->HasFastElements()) {
     return Top::Throw(Heap::illegal_argument_symbol());
   }
   FixedArray* fixed_array = FixedArray::cast(array->elements());
   if (fixed_array->length() < array_length) {
     array_length = fixed_array->length();
   }
 
   if (array_length == 0) {
     return Heap::empty_string();
   } else if (array_length == 1) {
     Object* first = fixed_array->get(0);
     if (first->IsString()) return first;
   }
 
-  bool ascii = special->IsAsciiRepresentation();
+  bool ascii = special_shape.IsAsciiRepresentation();
   int position = 0;
   for (int i = 0; i < array_length; i++) {
     Object* elt = fixed_array->get(i);
     if (elt->IsSmi()) {
       int len = Smi::cast(elt)->value();
       int pos = len >> 11;
       len &= 0x7ff;
       if (pos + len > special_length) {
         return Top::Throw(Heap::illegal_argument_symbol());
       }
       position += len;
     } else if (elt->IsString()) {
       String* element = String::cast(elt);
-      int element_length = element->length();
+      StringShape element_shape(element);
+      int element_length = element->length(element_shape);
       if (!Smi::IsValid(element_length + position)) {
         Top::context()->mark_out_of_memory();
         return Failure::OutOfMemoryException();
       }
       position += element_length;
-      if (ascii && !element->IsAsciiRepresentation()) {
+      if (ascii && !element_shape.IsAsciiRepresentation()) {
         ascii = false;
       }
     } else {
       return Top::Throw(Heap::illegal_argument_symbol());
     }
   }
 
   int length = position;
   Object* object;
 
   if (ascii) {
     object = Heap::AllocateRawAsciiString(length);
     if (object->IsFailure()) return object;
     SeqAsciiString* answer = SeqAsciiString::cast(object);
     StringBuilderConcatHelper(special,
+                              special_shape,
                               answer->GetChars(),
                               fixed_array,
                               array_length);
     return answer;
   } else {
     object = Heap::AllocateRawTwoByteString(length);
     if (object->IsFailure()) return object;
     SeqTwoByteString* answer = SeqTwoByteString::cast(object);
     StringBuilderConcatHelper(special,
+                              special_shape,
                               answer->GetChars(),
                               fixed_array,
                               array_length);
     return answer;
   }
 }
 
 
 static Object* Runtime_NumberOr(Arguments args) {
   NoHandleAllocation ha;
@@ skipping 174 matching lines @@
 }
 
 
 static Object* Runtime_StringCompare(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(String, x, args[0]);
   CONVERT_CHECKED(String, y, args[1]);
 
+  StringShape x_shape(x);
+  StringShape y_shape(y);
+
   // A few fast case tests before we flatten.
   if (x == y) return Smi::FromInt(EQUAL);
-  if (y->length() == 0) {
-    if (x->length() == 0) return Smi::FromInt(EQUAL);
+  if (y->length(y_shape) == 0) {
+    if (x->length(x_shape) == 0) return Smi::FromInt(EQUAL);
     return Smi::FromInt(GREATER);
-  } else if (x->length() == 0) {
+  } else if (x->length(x_shape) == 0) {
     return Smi::FromInt(LESS);
   }
 
-  int d = x->Get(0) - y->Get(0);
+  int d = x->Get(x_shape, 0) - y->Get(y_shape, 0);
   if (d < 0) return Smi::FromInt(LESS);
   else if (d > 0) return Smi::FromInt(GREATER);
 
-  x->TryFlatten();
-  y->TryFlatten();
+  x->TryFlatten(x_shape);  // Shapes are no longer valid!
+  y->TryFlatten(y_shape);
 
   static StringInputBuffer bufx;
   static StringInputBuffer bufy;
   bufx.Reset(x);
   bufy.Reset(y);
   while (bufx.has_more() && bufy.has_more()) {
     int d = bufx.GetNext() - bufy.GetNext();
     if (d < 0) return Smi::FromInt(LESS);
     else if (d > 0) return Smi::FromInt(GREATER);
   }
@@ skipping 2841 matching lines @@
   } else {
     // Handle last resort GC and make sure to allow future allocations
     // to grow the heap without causing GCs (if possible).
     Counters::gc_last_resort_from_js.Increment();
     Heap::CollectAllGarbage();
   }
 }
 
 
 } }  // namespace v8::internal