Refactor array construction for map, filter

This patch refactors array methods to have the
InnerArray{Map,Filter} methods convert to a GlobalArray
rather than the callers.

BUG=chromium:544991
R=yangguo,adamk
CC=mstarzinger,jochen
LOG=Y

Review URL: https://codereview.chromium.org/1408213004

Cr-Commit-Position: refs/heads/master@{#31403}

src/js/array.js

@@ -1201,7 +1201,9 @@ function InnerArrayFilter(f, receiver, array, length) {
       }
     }
   }
-  return accumulator;
+  var result = new GlobalArray();
+  %MoveArrayContents(accumulator, result);
+  return result;
 }
 
 function ArrayFilter(f, receiver) {
@@ -1211,10 +1213,7 @@ function ArrayFilter(f, receiver) {
   // loop will not affect the looping and side effects are visible.
   var array = TO_OBJECT(this);
   var length = TO_LENGTH_OR_UINT32(array.length);
-  var accumulator = InnerArrayFilter(f, receiver, array, length);
-  var result = new GlobalArray();
-  %MoveArrayContents(accumulator, result);
-  return result;
+  return InnerArrayFilter(f, receiver, array, length);
 }
 
 function InnerArrayForEach(f, receiver, array, length) {
@@ -1314,7 +1313,9 @@ function InnerArrayMap(f, receiver, array, length) {
       accumulator[i] = %_Call(f, receiver, element, i, array);
     }
   }
-  return accumulator;
+  var result = new GlobalArray();
+  %MoveArrayContents(accumulator, result);
+  return result;
 }
 
 
@@ -1325,10 +1326,7 @@ function ArrayMap(f, receiver) {
   // loop will not affect the looping and side effects are visible.
   var array = TO_OBJECT(this);
   var length = TO_LENGTH_OR_UINT32(array.length);
-  var accumulator = InnerArrayMap(f, receiver, array, length);
-  var result = new GlobalArray();
-  %MoveArrayContents(accumulator, result);
-  return result;
+  return InnerArrayMap(f, receiver, array, length);
 }
 
 

test/mjsunit/regress/regress-544991.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var typedArray = new Int8Array(1);
+var saved;
+var called;
+typedArray.constructor = function(x) { called = true; saved = x };
+typedArray.constructor.prototype = Int8Array.prototype;
+typedArray.map(function(){});
+
+// To meet the spec, constructor shouldn't be called directly, but
+// if it is called for now, the argument should be an Array
+assertTrue(called); // Will fail later; when so, delete this test
+assertEquals("Array", saved.constructor.name);