Recursion limit for one-char string replace and retire String::kMinNonFlatLength.

src/string.js

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 227 matching lines @@
       return %StringReplaceRegExpWithString(subject,
                                             search,
                                             TO_STRING_INLINE(replace),
                                             lastMatchInfo);
     }
   }
 
   // Convert the search argument to a string and search for it.
   search = TO_STRING_INLINE(search);
   if (search.length == 1 &&
+      subject.length > 0xFF &&

[Yang, 2012/01/17 13:07:34]

Dealing with short cons string the old way is better than traversing it.  This
especially makes celtic kane happy.

       IS_STRING(replace) &&
       %StringIndexOf(replace, '$', 0) < 0) {
+    // Searching by traversing a cons string tree and replace with cons of
+    // slices works only when the replaced string is a single character, being
+    // replaced by a simple string and only pays off for long strings.
     return %StringReplaceOneCharWithString(subject, search, replace);
   }
   var start = %StringIndexOf(subject, search, 0);
   if (start < 0) return subject;
   var end = start + search.length;
 
   var builder = new ReplaceResultBuilder(subject);
   // prefix
   builder.addSpecialSlice(0, start);
 
@@ skipping 744 matching lines @@
     "fixed", StringFixed,
     "italics", StringItalics,
     "small", StringSmall,
     "strike", StringStrike,
     "sub", StringSub,
     "sup", StringSup
   ));
 }
 
 SetUpString();