therubyracer 0.6.3 → 0.7.0.pre

data/ext/v8/upstream/2.1.10/src/splay-tree.h

@@ -0,0 +1,203 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef V8_SPLAY_TREE_H_
+#define V8_SPLAY_TREE_H_
+
+namespace v8 {
+namespace internal {
+
+
+// A splay tree.  The config type parameter encapsulates the different
+// configurations of a concrete splay tree:
+//
+//   typedef Key: the key type
+//   typedef Value: the value type
+//   static const kNoKey: the dummy key used when no key is set
+//   static const kNoValue: the dummy value used to initialize nodes
+//   int (Compare)(Key& a, Key& b) -> {-1, 0, 1}: comparison function
+//
+// The tree is also parameterized by an allocation policy
+// (Allocator). The policy is used for allocating lists in the C free
+// store or the zone; see zone.h.
+
+// Forward defined as
+// template <typename Config, class Allocator = FreeStoreAllocationPolicy>
+//     class SplayTree;
+template <typename Config, class Allocator>
+class SplayTree {
+ public:
+  typedef typename Config::Key Key;
+  typedef typename Config::Value Value;
+
+  class Locator;
+
+  SplayTree() : root_(NULL) { }
+  ~SplayTree();
+
+  INLINE(void* operator new(size_t size)) {
+    return Allocator::New(static_cast<int>(size));
+  }
+  INLINE(void operator delete(void* p, size_t)) { return Allocator::Delete(p); }
+
+  // Inserts the given key in this tree with the given value.  Returns
+  // true if a node was inserted, otherwise false.  If found the locator
+  // is enabled and provides access to the mapping for the key.
+  bool Insert(const Key& key, Locator* locator);
+
+  // Looks up the key in this tree and returns true if it was found,
+  // otherwise false.  If the node is found the locator is enabled and
+  // provides access to the mapping for the key.
+  bool Find(const Key& key, Locator* locator);
+
+  // Finds the mapping with the greatest key less than or equal to the
+  // given key.
+  bool FindGreatestLessThan(const Key& key, Locator* locator);
+
+  // Find the mapping with the greatest key in this tree.
+  bool FindGreatest(Locator* locator);
+
+  // Finds the mapping with the least key greater than or equal to the
+  // given key.
+  bool FindLeastGreaterThan(const Key& key, Locator* locator);
+
+  // Find the mapping with the least key in this tree.
+  bool FindLeast(Locator* locator);
+
+  // Move the node from one key to another.
+  bool Move(const Key& old_key, const Key& new_key);
+
+  // Remove the node with the given key from the tree.
+  bool Remove(const Key& key);
+
+  bool is_empty() { return root_ == NULL; }
+
+  // Perform the splay operation for the given key. Moves the node with
+  // the given key to the top of the tree.  If no node has the given
+  // key, the last node on the search path is moved to the top of the
+  // tree.
+  void Splay(const Key& key);
+
+  class Node {
+   public:
+    Node(const Key& key, const Value& value)
+        : key_(key),
+          value_(value),
+          left_(NULL),
+          right_(NULL) { }
+
+    INLINE(void* operator new(size_t size)) {
+      return Allocator::New(static_cast<int>(size));
+    }
+    INLINE(void operator delete(void* p, size_t)) {
+      return Allocator::Delete(p);
+    }
+
+    Key key() { return key_; }
+    Value value() { return value_; }
+    Node* left() { return left_; }
+    Node* right() { return right_; }
+   private:
+
+    friend class SplayTree;
+    friend class Locator;
+    Key key_;
+    Value value_;
+    Node* left_;
+    Node* right_;
+  };
+
+  // A locator provides access to a node in the tree without actually
+  // exposing the node.
+  class Locator BASE_EMBEDDED {
+   public:
+    explicit Locator(Node* node) : node_(node) { }
+    Locator() : node_(NULL) { }
+    const Key& key() { return node_->key_; }
+    Value& value() { return node_->value_; }
+    void set_value(const Value& value) { node_->value_ = value; }
+    inline void bind(Node* node) { node_ = node; }
+   private:
+    Node* node_;
+  };
+
+  template <class Callback>
+  void ForEach(Callback* callback);
+
+ protected:
+
+  // Resets tree root. Existing nodes become unreachable.
+  void ResetRoot() { root_ = NULL; }
+
+ private:
+  // Search for a node with a given key. If found, root_ points
+  // to the node.
+  bool FindInternal(const Key& key);
+
+  // Inserts a node assuming that root_ is already set up.
+  void InsertInternal(int cmp, Node* node);
+
+  // Removes root_ node.
+  void RemoveRootNode(const Key& key);
+
+  template<class Callback>
+  class NodeToPairAdaptor BASE_EMBEDDED {
+   public:
+    explicit NodeToPairAdaptor(Callback* callback)
+        : callback_(callback) { }
+    void Call(Node* node) {
+      callback_->Call(node->key(), node->value());
+    }
+
+   private:
+    Callback* callback_;
+
+    DISALLOW_COPY_AND_ASSIGN(NodeToPairAdaptor);
+  };
+
+  class NodeDeleter BASE_EMBEDDED {
+   public:
+    NodeDeleter() { }
+    void Call(Node* node) { delete node; }
+
+   private:
+
+    DISALLOW_COPY_AND_ASSIGN(NodeDeleter);
+  };
+
+  template <class Callback>
+  void ForEachNode(Callback* callback);
+
+  Node* root_;
+
+  DISALLOW_COPY_AND_ASSIGN(SplayTree);
+};
+
+
+} }  // namespace v8::internal
+
+#endif  // V8_SPLAY_TREE_H_

data/ext/v8/upstream/{2.0.6 → 2.1.10}/src/string.js

@@ -34,7 +34,7 @@
 
 // Set the String function and constructor.
 %SetCode($String, function(x) {
-  var value = %_ArgumentsLength() == 0 ? '' : ToString(x);
+  var value = %_ArgumentsLength() == 0 ? '' : TO_STRING_INLINE(x);
   if (%_IsConstructCall()) {
     %_SetValueOf(this, value);
   } else {
@@ -64,12 +64,12 @@ function StringValueOf() {
 function StringCharAt(pos) {
   var char_code = %_FastCharCodeAt(this, pos);
   if (!%_IsSmi(char_code)) {
-    var subject = ToString(this);
+    var subject = TO_STRING_INLINE(this);
     var index = TO_INTEGER(pos);
     if (index >= subject.length || index < 0) return "";
     char_code = %StringCharCodeAt(subject, index);
   }
-  return %CharFromCode(char_code);
+  return %_CharFromCode(char_code);
 }
 
 
@@ -79,7 +79,7 @@ function StringCharCodeAt(pos) {
   if (%_IsSmi(fast_answer)) {
     return fast_answer;
   }
-  var subject = ToString(this);
+  var subject = TO_STRING_INLINE(this);
   var index = TO_INTEGER(pos);
   return %StringCharCodeAt(subject, index);
 }
@@ -87,14 +87,18 @@ function StringCharCodeAt(pos) {
 
 // ECMA-262, section 15.5.4.6
 function StringConcat() {
-  var len = %_ArgumentsLength() + 1;
-  var parts = new $Array(len);
-  parts[0] = IS_STRING(this) ? this : ToString(this);
-  for (var i = 1; i < len; i++) {
-    var part = %_Arguments(i - 1);
-    parts[i] = IS_STRING(part) ? part : ToString(part);
+  var len = %_ArgumentsLength();
+  var this_as_string = TO_STRING_INLINE(this);
+  if (len === 1) {
+    return this_as_string + %_Arguments(0);
   }
-  return %StringBuilderConcat(parts, len, "");
+  var parts = new $Array(len + 1);
+  parts[0] = this_as_string;
+  for (var i = 0; i < len; i++) {
+    var part = %_Arguments(i);
+    parts[i + 1] = TO_STRING_INLINE(part);
+  }
+  return %StringBuilderConcat(parts, len + 1, "");
 }
 
 // Match ES3 and Safari
@@ -103,8 +107,8 @@ function StringConcat() {
 
 // ECMA-262 section 15.5.4.7
 function StringIndexOf(searchString /* position */) {  // length == 1
-  var subject_str = ToString(this);
-  var pattern_str = ToString(searchString);
+  var subject_str = TO_STRING_INLINE(this);
+  var pattern_str = TO_STRING_INLINE(searchString);
   var subject_str_len = subject_str.length;
   var pattern_str_len = pattern_str.length;
   var index = 0;
@@ -121,9 +125,9 @@ function StringIndexOf(searchString /* position */) {  // length == 1
 
 // ECMA-262 section 15.5.4.8
 function StringLastIndexOf(searchString /* position */) {  // length == 1
-  var sub = ToString(this);
+  var sub = TO_STRING_INLINE(this);
   var subLength = sub.length;
-  var pat = ToString(searchString);
+  var pat = TO_STRING_INLINE(searchString);
   var patLength = pat.length;
   var index = subLength - patLength;
   if (%_ArgumentsLength() > 1) {
@@ -145,6 +149,16 @@ function StringLastIndexOf(searchString /* position */) {  // length == 1
 }
 
 
+function CloneDenseArray(array) {
+  if (array === null) return null;
+  var clone = new $Array(array.length);
+  for (var i = 0; i < array.length; i++) {
+    clone[i] = array[i];
+  }
+  return clone;
+}
+
+
 // ECMA-262 section 15.5.4.9
 //
 // This function is implementation specific.  For now, we do not
@@ -152,21 +166,45 @@ function StringLastIndexOf(searchString /* position */) {  // length == 1
 function StringLocaleCompare(other) {
   if (%_ArgumentsLength() === 0) return 0;
 
-  var this_str = ToString(this);
-  var other_str = ToString(other);
+  var this_str = TO_STRING_INLINE(this);
+  var other_str = TO_STRING_INLINE(other);
   return %StringLocaleCompare(this_str, other_str);
 }
 
 
 // ECMA-262 section 15.5.4.10
 function StringMatch(regexp) {
-  if (!IS_REGEXP(regexp)) regexp = new ORIGINAL_REGEXP(regexp);
-  var subject = ToString(this);
-
-  if (!regexp.global) return regexp.exec(subject);
-  %_Log('regexp', 'regexp-match,%0S,%1r', [subject, regexp]);
-  // lastMatchInfo is defined in regexp-delay.js.
-  return %StringMatch(subject, regexp, lastMatchInfo);
+  var subject = TO_STRING_INLINE(this);
+  if (IS_REGEXP(regexp)) {
+    if (!regexp.global) return regexp.exec(subject);
+
+    var cache = regExpCache;
+    var saveAnswer = false;
+
+    if (%_ObjectEquals(cache.type, 'match') &&
+        %_ObjectEquals(cache.regExp, regexp) &&
+        %_ObjectEquals(cache.subject, subject)) {
+      if (cache.answerSaved) {
+        return CloneDenseArray(cache.answer);
+      } else {
+        saveAnswer = true;
+      }
+    }
+    %_Log('regexp', 'regexp-match,%0S,%1r', [subject, regexp]);
+    // lastMatchInfo is defined in regexp.js.
+    var result = %StringMatch(subject, regexp, lastMatchInfo);
+    cache.type = 'match';
+    cache.regExp = regexp;
+    cache.subject = subject;
+    if (saveAnswer) cache.answer = CloneDenseArray(result);
+    cache.answerSaved = saveAnswer;
+    return result;
+  }
+  // Non-regexp argument.
+  regexp = new $RegExp(regexp);
+  // Don't check regexp exec cache, since the regexp is new.
+  // TODO(lrn): Change this if we start caching regexps here.
+  return RegExpExecNoTests(regexp, subject, 0);
 }
 
 
@@ -180,7 +218,7 @@ function SubString(string, start, end) {
     if (!%_IsSmi(char_code)) {
       char_code = %StringCharCodeAt(string, start);
     }
-    return %CharFromCode(char_code);
+    return %_CharFromCode(char_code);
   }
   return %_SubString(string, start, end);
 }
@@ -196,12 +234,13 @@ var reusableMatchInfo = [2, "", "", -1, -1];
 
 // ECMA-262, section 15.5.4.11
 function StringReplace(search, replace) {
-  var subject = IS_STRING(this) ? this : ToString(this);
+  var subject = TO_STRING_INLINE(this);
 
   // Delegate to one of the regular expression variants if necessary.
   if (IS_REGEXP(search)) {
     %_Log('regexp', 'regexp-replace,%0r,%1S', [search, subject]);
     if (IS_FUNCTION(replace)) {
+      regExpCache.type = 'none';
       return StringReplaceRegExpWithFunction(subject, search, replace);
     } else {
       return StringReplaceRegExp(subject, search, replace);
@@ -209,7 +248,7 @@ function StringReplace(search, replace) {
   }
 
   // Convert the search argument to a string and search for it.
-  search = IS_STRING(search) ? search : ToString(search);
+  search = TO_STRING_INLINE(search);
   var start = %StringIndexOf(subject, search, 0);
   if (start < 0) return subject;
   var end = start + search.length;
@@ -224,7 +263,7 @@ function StringReplace(search, replace) {
   } else {
     reusableMatchInfo[CAPTURE0] = start;
     reusableMatchInfo[CAPTURE1] = end;
-    if (!IS_STRING(replace)) replace = ToString(replace);
+    replace = TO_STRING_INLINE(replace);
     ExpandReplacement(replace, subject, reusableMatchInfo, builder);
   }
 
@@ -237,12 +276,25 @@ function StringReplace(search, replace) {
 
 // Helper function for regular expressions in String.prototype.replace.
 function StringReplaceRegExp(subject, regexp, replace) {
-  replace = ToString(replace);
-  return %StringReplaceRegExpWithString(subject,
-                                        regexp,
-                                        replace,
-                                        lastMatchInfo);
-};
+  var cache = regExpCache;
+  if (%_ObjectEquals(cache.regExp, regexp) &&
+      %_ObjectEquals(cache.type, 'replace') &&
+      %_ObjectEquals(cache.replaceString, replace) &&
+      %_ObjectEquals(cache.subject, subject)) {
+    return cache.answer;
+  }
+  replace = TO_STRING_INLINE(replace);
+  var answer = %StringReplaceRegExpWithString(subject,
+                                              regexp,
+                                              replace,
+                                              lastMatchInfo);
+  cache.subject = subject;
+  cache.regExp = regexp;
+  cache.replaceString = replace;
+  cache.answer = answer;
+  cache.type = 'replace';
+  return answer;
+}
 
 
 // Expand the $-expressions in the string and return a new string with
@@ -364,72 +416,95 @@ function addCaptureString(builder, matchInfo, index) {
   builder.addSpecialSlice(start, end);
 };
 
+// TODO(lrn): This array will survive indefinitely if replace is never
+// called again. However, it will be empty, since the contents are cleared
+// in the finally block.
+var reusableReplaceArray = $Array(16);
 
 // Helper function for replacing regular expressions with the result of a
-// function application in String.prototype.replace.  The function application
-// must be interleaved with the regexp matching (contrary to ECMA-262
-// 15.5.4.11) to mimic SpiderMonkey and KJS behavior when the function uses
-// the static properties of the RegExp constructor.  Example:
-//     'abcd'.replace(/(.)/g, function() { return RegExp.$1; }
-// should be 'abcd' and not 'dddd' (or anything else).
+// function application in String.prototype.replace.
 function StringReplaceRegExpWithFunction(subject, regexp, replace) {
-  var matchInfo = DoRegExpExec(regexp, subject, 0);
-  if (IS_NULL(matchInfo)) return subject;
-
-  var result = new ReplaceResultBuilder(subject);
-  // There's at least one match.  If the regexp is global, we have to loop
-  // over all matches.  The loop is not in C++ code here like the one in
-  // RegExp.prototype.exec, because of the interleaved function application.
-  // Unfortunately, that means this code is nearly duplicated, here and in
-  // jsregexp.cc.
   if (regexp.global) {
-    var numberOfCaptures = NUMBER_OF_CAPTURES(matchInfo) >> 1;
-    var previous = 0;
-    do {
-      var startOfMatch = matchInfo[CAPTURE0];
-      result.addSpecialSlice(previous, startOfMatch);
-      previous = matchInfo[CAPTURE1];
-      if (numberOfCaptures == 1) {
-        var match = SubString(subject, startOfMatch, previous);
-        // Don't call directly to avoid exposing the built-in global object.
-        result.add(replace.call(null, match, startOfMatch, subject));
-      } else {
-        result.add(ApplyReplacementFunction(replace, matchInfo, subject));
+    var resultArray = reusableReplaceArray;
+    if (resultArray) {
+      reusableReplaceArray = null;
+    } else {
+      // Inside a nested replace (replace called from the replacement function
+      // of another replace) or we have failed to set the reusable array
+      // back due to an exception in a replacement function. Create a new
+      // array to use in the future, or until the original is written back.
+      resultArray = $Array(16);
+    }
+
+    var res = %RegExpExecMultiple(regexp,
+                                  subject,
+                                  lastMatchInfo,
+                                  resultArray);
+    regexp.lastIndex = 0;
+    if (IS_NULL(res)) {
+      // No matches at all.
+      return subject;
+    }
+    var len = res.length;
+    var i = 0;
+    if (NUMBER_OF_CAPTURES(lastMatchInfo) == 2) {
+      var match_start = 0;
+      var override = [null, 0, subject];
+      while (i < len) {
+        var elem = res[i];
+        if (%_IsSmi(elem)) {
+          if (elem > 0) {
+            match_start = (elem >> 11) + (elem & 0x7ff);
+          } else {
+            match_start = res[++i] - elem;
+          }
+        } else {
+          override[0] = elem;
+          override[1] = match_start;
+          lastMatchInfoOverride = override;
+          var func_result = replace.call(null, elem, match_start, subject);
+          if (!IS_STRING(func_result)) {
+            func_result = NonStringToString(func_result);
+          }
+          res[i] = func_result;
+          match_start += elem.length;
+        }
+        i++;
       }
-      // Can't use matchInfo any more from here, since the function could
-      // overwrite it.
-      // Continue with the next match.
-      // Increment previous if we matched an empty string, as per ECMA-262
-      // 15.5.4.10.
-      if (previous == startOfMatch) {
-        // Add the skipped character to the output, if any.
-        if (previous < subject.length) {
-          result.addSpecialSlice(previous, previous + 1);
+    } else {
+      while (i < len) {
+        var elem = res[i];
+        if (!%_IsSmi(elem)) {
+          // elem must be an Array.
+          // Use the apply argument as backing for global RegExp properties.
+          lastMatchInfoOverride = elem;
+          var func_result = replace.apply(null, elem);
+          if (!IS_STRING(func_result)) {
+            func_result = NonStringToString(func_result);
+          }
+          res[i] = func_result;
         }
-        previous++;
+        i++;
       }
-
-      // Per ECMA-262 15.10.6.2, if the previous index is greater than the
-      // string length, there is no match
-      matchInfo = (previous > subject.length)
-          ? null
-          : DoRegExpExec(regexp, subject, previous);
-    } while (!IS_NULL(matchInfo));
-
-    // Tack on the final right substring after the last match, if necessary.
-    if (previous < subject.length) {
-      result.addSpecialSlice(previous, subject.length);
     }
+    var resultBuilder = new ReplaceResultBuilder(subject, res);
+    var result = resultBuilder.generate();
+    resultArray.length = 0;
+    reusableReplaceArray = resultArray;
+    return result;
   } else { // Not a global regexp, no need to loop.
+    var matchInfo = DoRegExpExec(regexp, subject, 0);
+    if (IS_NULL(matchInfo)) return subject;
+
+    var result = new ReplaceResultBuilder(subject);
     result.addSpecialSlice(0, matchInfo[CAPTURE0]);
     var endOfMatch = matchInfo[CAPTURE1];
     result.add(ApplyReplacementFunction(replace, matchInfo, subject));
     // Can't use matchInfo any more from here, since the function could
     // overwrite it.
     result.addSpecialSlice(endOfMatch, subject.length);
+    return result.generate();
   }
-
-  return result.generate();
 }
 
 
@@ -454,25 +529,28 @@ function ApplyReplacementFunction(replace, matchInfo, subject) {
   return replace.apply(null, parameters);
 }
 
-
 // ECMA-262 section 15.5.4.12
 function StringSearch(re) {
-  var regexp = new ORIGINAL_REGEXP(re);
-  var s = ToString(this);
-  var last_idx = regexp.lastIndex; // keep old lastIndex
-  regexp.lastIndex = 0;            // ignore re.global property
-  var result = regexp.exec(s);
-  regexp.lastIndex = last_idx;     // restore lastIndex
-  if (result == null)
-    return -1;
-  else
-    return result.index;
+  var regexp;
+  if (IS_STRING(re)) {
+    regexp = %_GetFromCache(STRING_TO_REGEXP_CACHE_ID, re);
+  } else if (IS_REGEXP(re)) {
+    regexp = re;
+  } else {
+    regexp = new $RegExp(re);
+  }
+  var s = TO_STRING_INLINE(this);
+  var match = DoRegExpExec(regexp, s, 0);
+  if (match) {
+    return match[CAPTURE0];
+  }
+  return -1;
 }
 
 
 // ECMA-262 section 15.5.4.13
 function StringSlice(start, end) {
-  var s = ToString(this);
+  var s = TO_STRING_INLINE(this);
   var s_len = s.length;
   var start_i = TO_INTEGER(start);
   var end_i = s_len;
@@ -507,13 +585,13 @@ function StringSlice(start, end) {
 
 // ECMA-262 section 15.5.4.14
 function StringSplit(separator, limit) {
-  var subject = ToString(this);
+  var subject = TO_STRING_INLINE(this);
   limit = (IS_UNDEFINED(limit)) ? 0xffffffff : TO_UINT32(limit);
   if (limit === 0) return [];
 
   // ECMA-262 says that if separator is undefined, the result should
   // be an array of size 1 containing the entire string.  SpiderMonkey
-  // and KJS have this behaviour only when no separator is given.  If
+  // and KJS have this behavior only when no separator is given.  If
   // undefined is explicitly given, they convert it to a string and
   // use that.  We do as SpiderMonkey and KJS.
   if (%_ArgumentsLength() === 0) {
@@ -521,20 +599,44 @@ function StringSplit(separator, limit) {
   }
 
   var length = subject.length;
-  if (IS_REGEXP(separator)) {
-    %_Log('regexp', 'regexp-split,%0S,%1r', [subject, separator]);
-  } else {
-    separator = ToString(separator);
+  if (!IS_REGEXP(separator)) {
+    separator = TO_STRING_INLINE(separator);
+    var separator_length = separator.length;
+
     // If the separator string is empty then return the elements in the subject.
-    if (separator.length == 0) {
-      var result = $Array(length);
-      for (var i = 0; i < length; i++) result[i] = subject[i];
-      return result;
+    if (separator_length === 0) return %StringToArray(subject);
+
+    var result = %StringSplit(subject, separator, limit);
+
+    return result;
+  }
+
+  var cache = regExpCache;
+  var saveAnswer = false;
+
+  if (%_ObjectEquals(cache.type, 'split') &&
+      %_ObjectEquals(cache.regExp, separator) &&
+      %_ObjectEquals(cache.subject, subject)) {
+    if (cache.answerSaved) {
+      return CloneDenseArray(cache.answer);
+    } else {
+      saveAnswer = true;
     }
   }
 
+  cache.type = 'split';
+  cache.regExp = separator;
+  cache.subject = subject;
+
+  %_Log('regexp', 'regexp-split,%0S,%1r', [subject, separator]);
+
   if (length === 0) {
-    if (splitMatch(separator, subject, 0, 0) != null) return [];
+    cache.answerSaved = true;
+    if (splitMatch(separator, subject, 0, 0) != null) {
+      cache.answer = [];
+      return [];
+    }
+    cache.answer = [subject];
     return [subject];
   }
 
@@ -542,18 +644,19 @@ function StringSplit(separator, limit) {
   var startIndex = 0;
   var result = [];
 
+  outer_loop:
   while (true) {
 
     if (startIndex === length) {
       result[result.length] = subject.slice(currentIndex, length);
-      return result;
+      break;
     }
 
     var matchInfo = splitMatch(separator, subject, currentIndex, startIndex);
 
     if (IS_NULL(matchInfo)) {
       result[result.length] = subject.slice(currentIndex, length);
-      return result;
+      break;
     }
 
     var endIndex = matchInfo[CAPTURE1];
@@ -565,9 +668,10 @@ function StringSplit(separator, limit) {
     }
 
     result[result.length] = SubString(subject, currentIndex, matchInfo[CAPTURE0]);
-    if (result.length === limit) return result;
+    if (result.length === limit) break;
 
-    for (var i = 2; i < NUMBER_OF_CAPTURES(matchInfo); i += 2) {
+    var num_captures = NUMBER_OF_CAPTURES(matchInfo);
+    for (var i = 2; i < num_captures; i += 2) {
       var start = matchInfo[CAPTURE(i)];
       var end = matchInfo[CAPTURE(i + 1)];
       if (start != -1 && end != -1) {
@@ -575,11 +679,14 @@ function StringSplit(separator, limit) {
       } else {
         result[result.length] = void 0;
       }
-      if (result.length === limit) return result;
+      if (result.length === limit) break outer_loop;
     }
 
     startIndex = currentIndex = endIndex;
   }
+  if (saveAnswer) cache.answer = CloneDenseArray(result);
+  cache.answerSaved = saveAnswer;
+  return result;
 }
 
 
@@ -587,28 +694,18 @@ function StringSplit(separator, limit) {
 // Helper function used by split.  This version returns the matchInfo
 // instead of allocating a new array with basically the same information.
 function splitMatch(separator, subject, current_index, start_index) {
-  if (IS_REGEXP(separator)) {
-    var matchInfo = DoRegExpExec(separator, subject, start_index);
-    if (matchInfo == null) return null;
-    // Section 15.5.4.14 paragraph two says that we do not allow zero length
-    // matches at the end of the string.
-    if (matchInfo[CAPTURE0] === subject.length) return null;
-    return matchInfo;
-  }
-
-  var separatorIndex = subject.indexOf(separator, start_index);
-  if (separatorIndex === -1) return null;
-
-  reusableMatchInfo[CAPTURE0] = separatorIndex;
-  reusableMatchInfo[CAPTURE1] = separatorIndex + separator.length;
-  return reusableMatchInfo;
-};
+  var matchInfo = DoRegExpExec(separator, subject, start_index);
+  if (matchInfo == null) return null;
+  // Section 15.5.4.14 paragraph two says that we do not allow zero length
+  // matches at the end of the string.
+  if (matchInfo[CAPTURE0] === subject.length) return null;
+  return matchInfo;
+}
 
 
 // ECMA-262 section 15.5.4.15
 function StringSubstring(start, end) {
-  var s = this;
-  if (!IS_STRING(s)) s = ToString(s);
+  var s = TO_STRING_INLINE(this);
   var s_len = s.length;
 
   var start_i = TO_INTEGER(start);
@@ -639,7 +736,7 @@ function StringSubstring(start, end) {
 
 // This is not a part of ECMA-262.
 function StringSubstr(start, n) {
-  var s = ToString(this);
+  var s = TO_STRING_INLINE(this);
   var len;
 
   // Correct n: If not given, set to string length; if explicitly
@@ -677,60 +774,70 @@ function StringSubstr(start, n) {
 
 // ECMA-262, 15.5.4.16
 function StringToLowerCase() {
-  return %StringToLowerCase(ToString(this));
+  return %StringToLowerCase(TO_STRING_INLINE(this));
 }
 
 
 // ECMA-262, 15.5.4.17
 function StringToLocaleLowerCase() {
-  return %StringToLowerCase(ToString(this));
+  return %StringToLowerCase(TO_STRING_INLINE(this));
 }
 
 
 // ECMA-262, 15.5.4.18
 function StringToUpperCase() {
-  return %StringToUpperCase(ToString(this));
+  return %StringToUpperCase(TO_STRING_INLINE(this));
 }
 
 
 // ECMA-262, 15.5.4.19
 function StringToLocaleUpperCase() {
-  return %StringToUpperCase(ToString(this));
+  return %StringToUpperCase(TO_STRING_INLINE(this));
 }
 
 // ES5, 15.5.4.20
 function StringTrim() {
-  return %StringTrim(ToString(this), true, true);
+  return %StringTrim(TO_STRING_INLINE(this), true, true);
 }
 
 function StringTrimLeft() {
-  return %StringTrim(ToString(this), true, false);
+  return %StringTrim(TO_STRING_INLINE(this), true, false);
 }
 
 function StringTrimRight() {
-  return %StringTrim(ToString(this), false, true);
+  return %StringTrim(TO_STRING_INLINE(this), false, true);
 }
 
+var static_charcode_array = new $Array(4);
+
 // ECMA-262, section 15.5.3.2
 function StringFromCharCode(code) {
   var n = %_ArgumentsLength();
-  if (n == 1) return %CharFromCode(ToNumber(code) & 0xffff)
+  if (n == 1) {
+    if (!%_IsSmi(code)) code = ToNumber(code);
+    return %_CharFromCode(code & 0xffff);
+  }
 
   // NOTE: This is not super-efficient, but it is necessary because we
   // want to avoid converting to numbers from within the virtual
   // machine. Maybe we can find another way of doing this?
-  var codes = new $Array(n);
-  for (var i = 0; i < n; i++) codes[i] = ToNumber(%_Arguments(i));
+  var codes = static_charcode_array;
+  for (var i = 0; i < n; i++) {
+    var code = %_Arguments(i);
+    if (!%_IsSmi(code)) code = ToNumber(code);
+    codes[i] = code;
+  }
+  codes.length = n;
   return %StringFromCharCodeArray(codes);
 }
 
 
 // Helper function for very basic XSS protection.
 function HtmlEscape(str) {
-  return ToString(str).replace(/</g, "&lt;")
-                      .replace(/>/g, "&gt;")
-                      .replace(/"/g, "&quot;")
-                      .replace(/'/g, "&#039;");
+  return TO_STRING_INLINE(str).replace(/</g, "&lt;")
+                              .replace(/>/g, "&gt;")
+                              .replace(/"/g, "&quot;")
+                              .replace(/'/g, "&#039;");
 };
 
 
@@ -803,13 +910,17 @@ function StringSup() {
 
 // ReplaceResultBuilder support.
 function ReplaceResultBuilder(str) {
-  this.elements = new $Array();
+  if (%_ArgumentsLength() > 1) {
+    this.elements = %_Arguments(1);
+  } else {
+    this.elements = new $Array();
+  }
   this.special_string = str;
 }
 
 
 ReplaceResultBuilder.prototype.add = function(str) {
-  if (!IS_STRING(str)) str = ToString(str);
+  str = TO_STRING_INLINE(str);
   if (str.length > 0) {
     var elements = this.elements;
     elements[elements.length] = str;
@@ -819,10 +930,10 @@ ReplaceResultBuilder.prototype.add = function(str) {
 
 ReplaceResultBuilder.prototype.addSpecialSlice = function(start, end) {
   var len = end - start;
-  if (len == 0) return;
+  if (start < 0 || len <= 0) return;
   var elements = this.elements;
   if (start < 0x80000 && len < 0x800) {
-    elements[elements.length] = (start << 11) + len;
+    elements[elements.length] = (start << 11) | len;
   } else {
     // 0 < len <= String::kMaxLength and Smi::kMaxValue >= String::kMaxLength,
     // so -len is a smi.