Further Kraken regression recover due to handlification.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/223873004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20488 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/builtins.cc

@@ -278,6 +278,7 @@ static FixedArrayBase* LeftTrimFixedArray(Heap* heap,
 static bool ArrayPrototypeHasNoElements(Heap* heap,
                                         Context* native_context,
                                         JSObject* array_proto) {
+  DisallowHeapAllocation no_gc;
   // This method depends on non writability of Object and Array prototype
   // fields.
   if (array_proto->elements() != heap->empty_fixed_array()) return false;
@@ -324,6 +325,8 @@ static inline Handle<FixedArrayBase> EnsureJSArrayWithWritableFastElements(
   ElementsKind origin_kind = array->map()->elements_kind();
   ASSERT(!IsFastObjectElementsKind(origin_kind));
   ElementsKind target_kind = origin_kind;
+  {
+    DisallowHeapAllocation no_gc;
     int arg_count = args->length() - first_added_arg;
     Object** arguments = args->arguments() - first_added_arg - (arg_count - 1);
     for (int i = 0; i < arg_count; i++) {
@@ -337,6 +340,7 @@ static inline Handle<FixedArrayBase> EnsureJSArrayWithWritableFastElements(
         }
       }
     }
+  }
   if (target_kind != origin_kind) {
     JSObject::TransitionElementsKind(array, target_kind);
     return handle(array->elements(), isolate);
@@ -345,10 +349,10 @@ static inline Handle<FixedArrayBase> EnsureJSArrayWithWritableFastElements(
 }
 
 
-// TODO(ishell): Handlify when all Array* builtins are handlified.
 static inline bool IsJSArrayFastElementMovingAllowed(Heap* heap,
                                                      JSArray* receiver) {
   if (!FLAG_clever_optimizations) return false;
+  DisallowHeapAllocation no_gc;
   Context* native_context = heap->isolate()->context()->native_context();
   JSObject* array_proto =
       JSObject::cast(native_context->array_function()->prototype());
@@ -987,27 +991,30 @@ BUILTIN(ArraySplice) {
 
 BUILTIN(ArrayConcat) {
   HandleScope scope(isolate);
+
+  int n_arguments = args.length();
+  int result_len = 0;
+  ElementsKind elements_kind = GetInitialFastElementsKind();
+  bool has_double = false;
+  {
+    DisallowHeapAllocation no_gc;
     Heap* heap = isolate->heap();
-  Handle<Context> native_context(isolate->context()->native_context(), isolate);
-  Handle<JSObject> array_proto(
-      JSObject::cast(native_context->array_function()->prototype()), isolate);
-  if (!ArrayPrototypeHasNoElements(heap, *native_context, *array_proto)) {
+    Context* native_context = isolate->context()->native_context();
+    JSObject* array_proto =
+        JSObject::cast(native_context->array_function()->prototype());
+    if (!ArrayPrototypeHasNoElements(heap, native_context, array_proto)) {
+      AllowHeapAllocation allow_allocation;
       return CallJsBuiltin(isolate, "ArrayConcat", args);
     }
 
     // Iterate through all the arguments performing checks
     // and calculating total length.
-  int n_arguments = args.length();
-  int result_len = 0;
-  ElementsKind elements_kind = GetInitialFastElementsKind();
-  bool has_double = false;
     bool is_holey = false;
     for (int i = 0; i < n_arguments; i++) {
-    DisallowHeapAllocation no_gc;
       Object* arg = args[i];
       if (!arg->IsJSArray() ||
           !JSArray::cast(arg)->HasFastElements() ||
-        JSArray::cast(arg)->GetPrototype() != *array_proto) {
+          JSArray::cast(arg)->GetPrototype() != array_proto) {
         AllowHeapAllocation allow_allocation;
         return CallJsBuiltin(isolate, "ArrayConcat", args);
       }
@@ -1032,8 +1039,8 @@ BUILTIN(ArrayConcat) {
         elements_kind = arg_kind;
       }
     }
-
     if (is_holey) elements_kind = GetHoleyElementsKind(elements_kind);
+  }
 
   // If a double array is concatted into a fast elements array, the fast
   // elements array needs to be initialized to contain proper holes, since