BUG=

Review URL: https://codereview.chromium.org/1834613003

Cr-Commit-Position: refs/heads/master@{#35300}

Currently missing support for unshift.

BUG=

Review URL: https://chromiumcodereview.appspot.com/11377132

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Unfortunately, arguments is pretty much the normal JS object.  For now
I am adding more sanity checks (in hope that typically arguments
list is rather short.)  However it probably requires more systematic
treatment, for example, we could optimistically copy elements until
we meet first hole and in this case resort to JS builtin.

Review URL: http://codereview.chromium.org/6062006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6256 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Array.prototype.slice.call(arguments, ...) idiom is pretty common (up to 97% of invocations
in GMail), so we'd better handle it efficiently too.

Review URL: http://codereview.chromium.org/6034003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6085 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Bailout to JS Array builtins if array's prototype is different from
Array.prototype.  Otherwise there might be inherited elements coming
from this prototype.

Review URL: http://codereview.chromium.org/2037008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/669075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4026 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/604059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3871 ce2b1a6d-e550-0410-aec6-3dcde31c8c00