Merge WebKit at r65072 : Initial merge by git.

Change-Id: Ibcf418498376b2660aacb7f8d46ea7085ef91585

1 files changed, 138 insertions, 122 deletions

diff --git a/JavaScriptCore/runtime/JSArray.cpp b/JavaScriptCore/runtime/JSArray.cpp
index 99e1a10..0db0a63 100644
--- a/JavaScriptCore/runtime/JSArray.cpp
+++ b/JavaScriptCore/runtime/JSArray.cpp
@@ -126,17 +126,36 @@ inline void JSArray::checkConsistency(ConsistencyCheckType)
 
 #endif
 
+JSArray::JSArray(VPtrStealingHackType)
+    : JSObject(createStructure(jsNull()))
+{
+    unsigned initialCapacity = 0;
+
+    m_storage = static_cast<ArrayStorage*>(fastZeroedMalloc(storageSize(initialCapacity)));
+    m_storage->m_allocBase = m_storage;
+    m_indexBias = 0;
+    m_vectorLength = initialCapacity;
+
+    checkConsistency();
+    
+    // It's not safe to call Heap::heap(this) in order to report extra memory
+    // cost here, because the VPtrStealingHackType JSArray is not allocated on
+    // the heap. For the same reason, it's OK not to report extra cost.
+}
+
 JSArray::JSArray(NonNullPassRefPtr<Structure> structure)
     : JSObject(structure)
 {
     unsigned initialCapacity = 0;
 
-    ArrayStorage* storage = static_cast<ArrayStorage*>(fastZeroedMalloc(storageSize(initialCapacity)));
+    m_storage = static_cast<ArrayStorage*>(fastZeroedMalloc(storageSize(initialCapacity)));
+    m_storage->m_allocBase = m_storage;
     m_indexBias = 0;
-    setArrayStorage(storage);
     m_vectorLength = initialCapacity;
 
     checkConsistency();
+
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(0));
 }
 
 JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength, ArrayCreationMode creationMode)
@@ -148,35 +167,35 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength,
     else
         initialCapacity = min(BASE_VECTOR_LEN, MIN_SPARSE_ARRAY_INDEX);
     
-    ArrayStorage* storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
-    storage->m_length = initialLength;
+    m_storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
+    m_storage->m_allocBase = m_storage;
+    m_storage->m_length = initialLength;
     m_indexBias = 0;
     m_vectorLength = initialCapacity;
-    setArrayStorage(storage);    
-    storage->m_sparseValueMap = 0;
-    storage->subclassData = 0;
-    storage->reportedMapCapacity = 0;
+    m_storage->m_sparseValueMap = 0;
+    m_storage->subclassData = 0;
+    m_storage->reportedMapCapacity = 0;
 
     if (creationMode == CreateCompact) {
 #if CHECK_ARRAY_CONSISTENCY
-        storage->m_inCompactInitialization = !!initialCapacity;
+        m_storage->m_inCompactInitialization = !!initialCapacity;
 #endif
-        storage->m_length = 0;
-        storage->m_numValuesInVector = initialCapacity;
+        m_storage->m_length = 0;
+        m_storage->m_numValuesInVector = initialCapacity;
     } else {
 #if CHECK_ARRAY_CONSISTENCY
         storage->m_inCompactInitialization = false;
 #endif
-        storage->m_length = initialLength;
-        storage->m_numValuesInVector = 0;
-        JSValue* vector = m_vector;
+        m_storage->m_length = initialLength;
+        m_storage->m_numValuesInVector = 0;
+        JSValue* vector = m_storage->m_vector;
         for (size_t i = 0; i < initialCapacity; ++i)
             vector[i] = JSValue();
     }
 
     checkConsistency();
     
-    Heap::heap(this)->reportExtraMemoryCost(initialCapacity * sizeof(JSValue));
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(initialCapacity));
 }
 
 JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
@@ -184,21 +203,21 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
 {
     unsigned initialCapacity = list.size();
 
-    ArrayStorage* storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
+    m_storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
+    m_storage->m_allocBase = m_storage;
     m_indexBias = 0;
-    storage->m_length = initialCapacity;
+    m_storage->m_length = initialCapacity;
     m_vectorLength = initialCapacity;
-    storage->m_numValuesInVector = initialCapacity;
-    storage->m_sparseValueMap = 0;
-    storage->subclassData = 0;
-    storage->reportedMapCapacity = 0;
+    m_storage->m_numValuesInVector = initialCapacity;
+    m_storage->m_sparseValueMap = 0;
+    m_storage->subclassData = 0;
+    m_storage->reportedMapCapacity = 0;
 #if CHECK_ARRAY_CONSISTENCY
-    storage->m_inCompactInitialization = false;
+    m_storage->m_inCompactInitialization = false;
 #endif
-    setArrayStorage(storage);
 
     size_t i = 0;
-    JSValue* vector = m_vector;
+    JSValue* vector = m_storage->m_vector;
     ArgList::const_iterator end = list.end();
     for (ArgList::const_iterator it = list.begin(); it != end; ++it, ++i)
         vector[i] = *it;
@@ -213,15 +232,13 @@ JSArray::~JSArray()
     ASSERT(vptr() == JSGlobalData::jsArrayVPtr);
     checkConsistency(DestructorConsistencyCheck);
 
-    ArrayStorage* storage = arrayStorage();
-    delete storage->m_sparseValueMap;
-    char* realStorage = reinterpret_cast<char*>(storage) - (m_indexBias * sizeof(JSValue));
-    fastFree(realStorage);
+    delete m_storage->m_sparseValueMap;
+    fastFree(m_storage->m_allocBase);
 }
 
 bool JSArray::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& slot)
 {
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
     
     if (i >= storage->m_length) {
         if (i > MAX_ARRAY_INDEX)
@@ -230,7 +247,7 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& slot
     }
 
     if (i < m_vectorLength) {
-        JSValue& valueSlot = m_vector[i];
+        JSValue& valueSlot = storage->m_vector[i];
         if (valueSlot) {
             slot.setValueSlot(&valueSlot);
             return true;
@@ -270,7 +287,7 @@ bool JSArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& proper
         return true;
     }
 
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
     
     bool isArrayIndex;
     unsigned i = propertyName.toArrayIndex(&isArrayIndex);
@@ -278,7 +295,7 @@ bool JSArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& proper
         if (i >= storage->m_length)
             return false;
         if (i < m_vectorLength) {
-            JSValue& value = m_vector[i];
+            JSValue& value = storage->m_vector[i];
             if (value) {
                 descriptor.setDescriptor(value, 0);
                 return true;
@@ -323,7 +340,7 @@ void JSArray::put(ExecState* exec, unsigned i, JSValue value)
 {
     checkConsistency();
 
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
 
     unsigned length = storage->m_length;
     if (i >= length && i <= MAX_ARRAY_INDEX) {
@@ -332,7 +349,7 @@ void JSArray::put(ExecState* exec, unsigned i, JSValue value)
     }
 
     if (i < m_vectorLength) {
-        JSValue& valueSlot = m_vector[i];
+        JSValue& valueSlot = storage->m_vector[i];
         if (valueSlot) {
             valueSlot = value;
             checkConsistency();
@@ -349,7 +366,7 @@ void JSArray::put(ExecState* exec, unsigned i, JSValue value)
 
 NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue value)
 {
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
     
     SparseArrayValueMap* map = storage->m_sparseValueMap;
 
@@ -387,8 +404,9 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
     // Fast case is when there is no sparse map, so we can increase the vector size without moving values from it.
     if (!map || map->isEmpty()) {
         if (increaseVectorLength(i + 1)) {
-            m_vector[i] = value;
-            ++arrayStorage()->m_numValuesInVector;
+            storage = m_storage;
+            storage->m_vector[i] = value;
+            ++storage->m_numValuesInVector;
             checkConsistency();
         } else
             throwOutOfMemoryError(exec);
@@ -416,29 +434,30 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
         }
     }
 
-    int baseBias = m_indexBias * sizeof(JSValue);
-    char* baseStorage = reinterpret_cast<char*>(storage - baseBias);
+    void* baseStorage = storage->m_allocBase;
     
     if (!tryFastRealloc(baseStorage, storageSize(newVectorLength + m_indexBias)).getValue(baseStorage)) {
         throwOutOfMemoryError(exec);
         return;
     }
 
-    storage = reinterpret_cast<ArrayStorage*>(baseStorage + baseBias);
-    setArrayStorage(storage);
+    m_storage = reinterpret_cast<ArrayStorage*>(static_cast<char*>(baseStorage) + m_indexBias * sizeof(JSValue));
+    m_storage->m_allocBase = baseStorage;
+    storage = m_storage;
     
     unsigned vectorLength = m_vectorLength;
+    JSValue* vector = storage->m_vector;
 
     if (newNumValuesInVector == storage->m_numValuesInVector + 1) {
         for (unsigned j = vectorLength; j < newVectorLength; ++j)
-            m_vector[j] = JSValue();
+            vector[j] = JSValue();
         if (i > MIN_SPARSE_ARRAY_INDEX)
             map->remove(i);
     } else {
         for (unsigned j = vectorLength; j < max(vectorLength, MIN_SPARSE_ARRAY_INDEX); ++j)
-            m_vector[j] = JSValue();
+            vector[j] = JSValue();
         for (unsigned j = max(vectorLength, MIN_SPARSE_ARRAY_INDEX); j < newVectorLength; ++j)
-            m_vector[j] = map->take(j);
+            vector[j] = map->take(j);
     }
 
     ASSERT(i < newVectorLength);
@@ -446,7 +465,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
     m_vectorLength = newVectorLength;
     storage->m_numValuesInVector = newNumValuesInVector;
 
-    m_vector[i] = value;
+    storage->m_vector[i] = value;
 
     checkConsistency();
 
@@ -470,10 +489,10 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
 {
     checkConsistency();
 
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
     
     if (i < m_vectorLength) {
-        JSValue& valueSlot = m_vector[i];
+        JSValue& valueSlot = storage->m_vector[i];
         if (!valueSlot) {
             checkConsistency();
             return false;
@@ -509,11 +528,11 @@ void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNa
     // is incredibly inefficient for large arrays. We need a different approach,
     // which almost certainly means a different structure for PropertyNameArray.
 
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
     
     unsigned usedVectorLength = min(storage->m_length, m_vectorLength);
     for (unsigned i = 0; i < usedVectorLength; ++i) {
-        if (m_vector[i])
+        if (storage->m_vector[i])
             propertyNames.add(Identifier::from(exec, i));
     }
 
@@ -534,7 +553,7 @@ ALWAYS_INLINE unsigned JSArray::getNewVectorLength(unsigned desiredLength)
     ASSERT(desiredLength <= MAX_STORAGE_VECTOR_LENGTH);
 
     unsigned increasedLength;
-    unsigned length = arrayStorage()->m_length;
+    unsigned length = m_storage->m_length;
 
     if (desiredLength < length)
         increasedLength = length;
@@ -561,22 +580,21 @@ bool JSArray::increaseVectorLength(unsigned newLength)
     // This function leaves the array in an internally inconsistent state, because it does not move any values from sparse value map
     // to the vector. Callers have to account for that, because they can do it more efficiently.
 
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
 
     unsigned vectorLength = m_vectorLength;
     ASSERT(newLength > vectorLength);
     ASSERT(newLength <= MAX_STORAGE_VECTOR_INDEX);
     unsigned newVectorLength = getNewVectorLength(newLength);
-    int baseBias = m_indexBias * sizeof(JSValue);
-    char* baseStorage = reinterpret_cast<char*>(storage) - baseBias;
+    void* baseStorage = storage->m_allocBase;
 
     if (!tryFastRealloc(baseStorage, storageSize(newVectorLength + m_indexBias)).getValue(baseStorage))
         return false;
-    
-    storage = reinterpret_cast<ArrayStorage*>(baseStorage + baseBias);
-    setArrayStorage(storage);
 
-    JSValue* vector = m_vector;
+    storage = m_storage = reinterpret_cast<ArrayStorage*>(static_cast<char*>(baseStorage) + m_indexBias * sizeof(JSValue));
+    m_storage->m_allocBase = baseStorage;
+
+    JSValue* vector = storage->m_vector;
     for (unsigned i = vectorLength; i < newVectorLength; ++i)
         vector[i] = JSValue();
 
@@ -592,33 +610,29 @@ bool JSArray::increaseVectorPrefixLength(unsigned newLength)
     // This function leaves the array in an internally inconsistent state, because it does not move any values from sparse value map
     // to the vector. Callers have to account for that, because they can do it more efficiently.
     
-    ArrayStorage* storage = arrayStorage();
-    ArrayStorage* newStorage;
+    ArrayStorage* storage = m_storage;
     
     unsigned vectorLength = m_vectorLength;
     ASSERT(newLength > vectorLength);
     ASSERT(newLength <= MAX_STORAGE_VECTOR_INDEX);
     unsigned newVectorLength = getNewVectorLength(newLength);
-    char* baseStorage = reinterpret_cast<char*>(storage) - (m_indexBias * sizeof(JSValue));
-    
-    char* newBaseStorage = reinterpret_cast<char*>(fastMalloc(storageSize(newVectorLength + m_indexBias)));
+
+    void* newBaseStorage = fastMalloc(storageSize(newVectorLength + m_indexBias));
     if (!newBaseStorage)
         return false;
     
     m_indexBias += newVectorLength - newLength;
-    int newStorageOffset = m_indexBias * sizeof(JSValue);
-    
-    newStorage = reinterpret_cast<ArrayStorage*>(newBaseStorage + newStorageOffset);
     
-    memcpy(newStorage, storage, storageSize(0));
-    memcpy(&newStorage->m_vector[newLength - m_vectorLength], &storage->m_vector[0], storage->m_length * sizeof(JSValue));
+    m_storage = reinterpret_cast<ArrayStorage*>(static_cast<char*>(newBaseStorage) + m_indexBias * sizeof(JSValue));
+
+    memcpy(m_storage, storage, storageSize(0));
+    memcpy(&m_storage->m_vector[newLength - m_vectorLength], &storage->m_vector[0], vectorLength * sizeof(JSValue));
     
+    m_storage->m_allocBase = newBaseStorage;
     m_vectorLength = newLength;
     
-    fastFree(baseStorage);
+    fastFree(storage->m_allocBase);
 
-    setArrayStorage(newStorage);
-    
     Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
     
     return true;
@@ -627,21 +641,21 @@ bool JSArray::increaseVectorPrefixLength(unsigned newLength)
 
 void JSArray::setLength(unsigned newLength)
 {
+    ArrayStorage* storage = m_storage;
+    
 #if CHECK_ARRAY_CONSISTENCY
-    if (!m_storage->m_inCompactInitialization)
+    if (!storage->m_inCompactInitialization)
         checkConsistency();
     else
-        m_storage->m_inCompactInitialization = false;
+        storage->m_inCompactInitialization = false;
 #endif
 
-    ArrayStorage* storage = arrayStorage();
-    
     unsigned length = storage->m_length;
 
     if (newLength < length) {
         unsigned usedVectorLength = min(length, m_vectorLength);
         for (unsigned i = newLength; i < usedVectorLength; ++i) {
-            JSValue& valueSlot = m_vector[i];
+            JSValue& valueSlot = storage->m_vector[i];
             bool hadValue = valueSlot;
             valueSlot = JSValue();
             storage->m_numValuesInVector -= hadValue;
@@ -670,7 +684,7 @@ JSValue JSArray::pop()
 {
     checkConsistency();
 
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
     
     unsigned length = storage->m_length;
     if (!length)
@@ -681,7 +695,7 @@ JSValue JSArray::pop()
     JSValue result;
 
     if (length < m_vectorLength) {
-        JSValue& valueSlot = m_vector[length];
+        JSValue& valueSlot = storage->m_vector[length];
         if (valueSlot) {
             --storage->m_numValuesInVector;
             result = valueSlot;
@@ -714,10 +728,10 @@ void JSArray::push(ExecState* exec, JSValue value)
 {
     checkConsistency();
     
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
 
     if (storage->m_length < m_vectorLength) {
-        m_vector[storage->m_length] = value;
+        storage->m_vector[storage->m_length] = value;
         ++storage->m_numValuesInVector;
         ++storage->m_length;
         checkConsistency();
@@ -728,8 +742,8 @@ void JSArray::push(ExecState* exec, JSValue value)
         SparseArrayValueMap* map = storage->m_sparseValueMap;
         if (!map || map->isEmpty()) {
             if (increaseVectorLength(storage->m_length + 1)) {
-                storage = arrayStorage();
-                m_vector[storage->m_length] = value;
+                storage = m_storage;
+                storage->m_vector[storage->m_length] = value;
                 ++storage->m_numValuesInVector;
                 ++storage->m_length;
                 checkConsistency();
@@ -748,7 +762,7 @@ void JSArray::shiftCount(ExecState* exec, int count)
 {
     ASSERT(count > 0);
     
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
     
     unsigned oldLength = storage->m_length;
     
@@ -761,7 +775,7 @@ void JSArray::shiftCount(ExecState* exec, int count)
         // slots and then fill them with possible properties.  See ECMA spec.
         // 15.4.4.9 steps 11 through 13.
         for (unsigned i = count; i < oldLength; ++i) {
-            if ((i >= m_vectorLength) || (!m_vector[i])) {
+            if ((i >= m_vectorLength) || (!m_storage->m_vector[i])) {
                 PropertySlot slot(this);
                 JSValue p = prototype();
                 if ((!p.isNull()) && (asObject(p)->getPropertySlot(exec, i, slot)))
@@ -769,11 +783,11 @@ void JSArray::shiftCount(ExecState* exec, int count)
             }
         }
 
-        storage = arrayStorage(); // The put() above could have grown the vector and realloc'ed storage.
+        storage = m_storage; // The put() above could have grown the vector and realloc'ed storage.
 
         // Need to decrement numValuesInvector based on number of real entries
         for (unsigned i = 0; i < (unsigned)count; ++i)
-            if ((i < m_vectorLength) && (m_vector[i]))
+            if ((i < m_vectorLength) && (storage->m_vector[i]))
                 --storage->m_numValuesInVector;
     } else
         storage->m_numValuesInVector -= count;
@@ -788,17 +802,16 @@ void JSArray::shiftCount(ExecState* exec, int count)
         if (m_vectorLength) {
             char* newBaseStorage = reinterpret_cast<char*>(storage) + count * sizeof(JSValue);
             memmove(newBaseStorage, storage, storageSize(0));
-            storage = reinterpret_cast<ArrayStorage*>(newBaseStorage);
+            m_storage = reinterpret_cast<ArrayStorage*>(newBaseStorage);
 
             m_indexBias += count;
-            setArrayStorage(storage);
         }
     }
 }
     
 void JSArray::unshiftCount(ExecState* exec, int count)
 {
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
 
     ASSERT(m_indexBias >= 0);
     ASSERT(count >= 0);
@@ -811,7 +824,7 @@ void JSArray::unshiftCount(ExecState* exec, int count)
         // slots and then fill them with possible properties.  See ECMA spec.
         // 15.4.4.13 steps 8 through 10.
         for (unsigned i = 0; i < length; ++i) {
-            if ((i >= m_vectorLength) || (!m_vector[i])) {
+            if ((i >= m_vectorLength) || (!m_storage->m_vector[i])) {
                 PropertySlot slot(this);
                 JSValue p = prototype();
                 if ((!p.isNull()) && (asObject(p)->getPropertySlot(exec, i, slot)))
@@ -820,19 +833,22 @@ void JSArray::unshiftCount(ExecState* exec, int count)
         }
     }
     
-    storage = arrayStorage(); // The put() above could have grown the vector and realloc'ed storage.
+    storage = m_storage; // The put() above could have grown the vector and realloc'ed storage.
     
     if (m_indexBias >= count) {
         m_indexBias -= count;
         char* newBaseStorage = reinterpret_cast<char*>(storage) - count * sizeof(JSValue);
         memmove(newBaseStorage, storage, storageSize(0));
-        storage = reinterpret_cast<ArrayStorage*>(newBaseStorage);
-        setArrayStorage(storage);
+        m_storage = reinterpret_cast<ArrayStorage*>(newBaseStorage);
         m_vectorLength += count;
-    } else if ((!m_indexBias) && (!increaseVectorPrefixLength(m_vectorLength + count))) {
+    } else if (!increaseVectorPrefixLength(m_vectorLength + count)) {
         throwOutOfMemoryError(exec);
         return;
     }
+
+    JSValue* vector = m_storage->m_vector;
+    for (int i = 0; i < count; i++)
+        vector[i] = JSValue();
 }
 
 void JSArray::markChildren(MarkStack& markStack)
@@ -858,7 +874,7 @@ static int compareByStringPairForQSort(const void* a, const void* b)
 
 void JSArray::sortNumeric(ExecState* exec, JSValue compareFunction, CallType callType, const CallData& callData)
 {
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
 
     unsigned lengthNotIncludingUndefined = compactForSorting();
     if (storage->m_sparseValueMap) {
@@ -872,7 +888,7 @@ void JSArray::sortNumeric(ExecState* exec, JSValue compareFunction, CallType cal
     bool allValuesAreNumbers = true;
     size_t size = storage->m_numValuesInVector;
     for (size_t i = 0; i < size; ++i) {
-        if (!m_vector[i].isNumber()) {
+        if (!storage->m_vector[i].isNumber()) {
             allValuesAreNumbers = false;
             break;
         }
@@ -884,14 +900,14 @@ void JSArray::sortNumeric(ExecState* exec, JSValue compareFunction, CallType cal
     // For numeric comparison, which is fast, qsort is faster than mergesort. We
     // also don't require mergesort's stability, since there's no user visible
     // side-effect from swapping the order of equal primitive values.
-    qsort(m_vector, size, sizeof(JSValue), compareNumbersForQSort);
+    qsort(storage->m_vector, size, sizeof(JSValue), compareNumbersForQSort);
 
     checkConsistency(SortConsistencyCheck);
 }
 
 void JSArray::sort(ExecState* exec)
 {
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
 
     unsigned lengthNotIncludingUndefined = compactForSorting();
     if (storage->m_sparseValueMap) {
@@ -914,7 +930,7 @@ void JSArray::sort(ExecState* exec)
     }
 
     for (size_t i = 0; i < lengthNotIncludingUndefined; i++) {
-        JSValue value = m_vector[i];
+        JSValue value = storage->m_vector[i];
         ASSERT(!value.isUndefined());
         values[i].first = value;
     }
@@ -946,7 +962,7 @@ void JSArray::sort(ExecState* exec)
     // modifying the vector incorrectly.
 
     for (size_t i = 0; i < lengthNotIncludingUndefined; i++)
-        m_vector[i] = values[i].first;
+        storage->m_vector[i] = values[i].first;
 
     checkConsistency(SortConsistencyCheck);
 }
@@ -1033,7 +1049,7 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
 {
     checkConsistency();
 
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
 
     // FIXME: This ignores exceptions raised in the compare function or in toNumber.
 
@@ -1072,14 +1088,14 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
 
     // Iterate over the array, ignoring missing values, counting undefined ones, and inserting all other ones into the tree.
     for (; numDefined < usedVectorLength; ++numDefined) {
-        JSValue v = m_vector[numDefined];
+        JSValue v = storage->m_vector[numDefined];
         if (!v || v.isUndefined())
             break;
         tree.abstractor().m_nodes[numDefined].value = v;
         tree.insert(numDefined);
     }
     for (unsigned i = numDefined; i < usedVectorLength; ++i) {
-        JSValue v = m_vector[i];
+        JSValue v = storage->m_vector[i];
         if (v) {
             if (v.isUndefined())
                 ++numUndefined;
@@ -1103,7 +1119,7 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
             }
         }
         
-        storage = arrayStorage();
+        storage = m_storage;
 
         SparseArrayValueMap::iterator end = map->end();
         for (SparseArrayValueMap::iterator it = map->begin(); it != end; ++it) {
@@ -1125,17 +1141,17 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
     AVLTree<AVLTreeAbstractorForArrayCompare, 44>::Iterator iter;
     iter.start_iter_least(tree);
     for (unsigned i = 0; i < numDefined; ++i) {
-        m_vector[i] = tree.abstractor().m_nodes[*iter].value;
+        storage->m_vector[i] = tree.abstractor().m_nodes[*iter].value;
         ++iter;
     }
 
     // Put undefined values back in.
     for (unsigned i = numDefined; i < newUsedVectorLength; ++i)
-        m_vector[i] = jsUndefined();
+        storage->m_vector[i] = jsUndefined();
 
     // Ensure that unused values in the vector are zeroed out.
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
-        m_vector[i] = JSValue();
+        storage->m_vector[i] = JSValue();
 
     storage->m_numValuesInVector = newUsedVectorLength;
 
@@ -1144,7 +1160,7 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
 
 void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
 {
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
 
     JSValue* vector = storage->m_vector;
     unsigned vectorEnd = min(storage->m_length, m_vectorLength);
@@ -1162,9 +1178,9 @@ void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
 
 void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize)
 {
-    ASSERT(arrayStorage()->m_length >= maxSize);
+    ASSERT(m_storage->m_length >= maxSize);
     UNUSED_PARAM(maxSize);
-    JSValue* vector = m_vector;
+    JSValue* vector = m_storage->m_vector;
     unsigned vectorEnd = min(maxSize, m_vectorLength);
     unsigned i = 0;
     for (; i < vectorEnd; ++i) {
@@ -1182,7 +1198,7 @@ unsigned JSArray::compactForSorting()
 {
     checkConsistency();
 
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
 
     unsigned usedVectorLength = min(storage->m_length, m_vectorLength);
 
@@ -1190,17 +1206,17 @@ unsigned JSArray::compactForSorting()
     unsigned numUndefined = 0;
 
     for (; numDefined < usedVectorLength; ++numDefined) {
-        JSValue v = m_vector[numDefined];
+        JSValue v = storage->m_vector[numDefined];
         if (!v || v.isUndefined())
             break;
     }
     for (unsigned i = numDefined; i < usedVectorLength; ++i) {
-        JSValue v = m_vector[i];
+        JSValue v = storage->m_vector[i];
         if (v) {
             if (v.isUndefined())
                 ++numUndefined;
             else
-                m_vector[numDefined++] = v;
+                storage->m_vector[numDefined++] = v;
         }
     }
 
@@ -1214,21 +1230,21 @@ unsigned JSArray::compactForSorting()
             if ((newUsedVectorLength > MAX_STORAGE_VECTOR_LENGTH) || !increaseVectorLength(newUsedVectorLength))
                 return 0;
 
-            storage = arrayStorage();
+            storage = m_storage;
         }
 
         SparseArrayValueMap::iterator end = map->end();
         for (SparseArrayValueMap::iterator it = map->begin(); it != end; ++it)
-            m_vector[numDefined++] = it->second;
+            storage->m_vector[numDefined++] = it->second;
 
         delete map;
         storage->m_sparseValueMap = 0;
     }
 
     for (unsigned i = numDefined; i < newUsedVectorLength; ++i)
-        m_vector[i] = jsUndefined();
+        storage->m_vector[i] = jsUndefined();
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
-        m_vector[i] = JSValue();
+        storage->m_vector[i] = JSValue();
 
     storage->m_numValuesInVector = newUsedVectorLength;
 
@@ -1239,19 +1255,19 @@ unsigned JSArray::compactForSorting()
 
 void* JSArray::subclassData() const
 {
-    return arrayStorage()->subclassData;
+    return m_storage->subclassData;
 }
 
 void JSArray::setSubclassData(void* d)
 {
-    arrayStorage()->subclassData = d;
+    m_storage->subclassData = d;
 }
 
 #if CHECK_ARRAY_CONSISTENCY
 
 void JSArray::checkConsistency(ConsistencyCheckType type)
 {
-    ArrayStorage* storage = arrayStorage();
+    ArrayStorage* storage = m_storage;
 
     ASSERT(storage);
     if (type == SortConsistencyCheck)
@@ -1259,7 +1275,7 @@ void JSArray::checkConsistency(ConsistencyCheckType type)
 
     unsigned numValuesInVector = 0;
     for (unsigned i = 0; i < m_vectorLength; ++i) {
-        if (JSValue value = m_vector[i]) {
+        if (JSValue value = storage->m_vector[i]) {
             ASSERT(i < storage->m_length);
             if (type != DestructorConsistencyCheck)
                 value.isUndefined(); // Likely to crash if the object was deallocated.
@@ -1277,7 +1293,7 @@ void JSArray::checkConsistency(ConsistencyCheckType type)
         for (SparseArrayValueMap::iterator it = storage->m_sparseValueMap->begin(); it != end; ++it) {
             unsigned index = it->first;
             ASSERT(index < storage->m_length);
-            ASSERT(index >= m_vectorLength);
+            ASSERT(index >= storage->m_vectorLength);
             ASSERT(index <= MAX_ARRAY_INDEX);
             ASSERT(it->second);
             if (type != DestructorConsistencyCheck)