Trace String.prototype.substring for two-arg case.

* Export str_substring as js_str_substring.
* Add basic String_p_substring builtin (only handle end > begin, both in range).
* Add String_p_substring_1 builtin for the missing-end case.
* INS_CONST for named constants in traces.
* Support boxing of strings.
* Support CALLPROP with primitive this.
* Support traceable natives which require cx and this.
* Support fallible traceable natives.
* Fix JSOP_LENGTH to use i2f on result (need that everything-is-doubles T-shirt).
* Add strings test.

js/src/jsbuiltins.cpp

@@ -49,6 +49,7 @@
 #include "jscntxt.h"
 #include "nanojit/avmplus.h"
 #include "nanojit/nanojit.h"
+#include "jsstr.h"
 #include "jstracer.h"
 
 using namespace nanojit;
@@ -170,6 +171,21 @@ bool FASTCALL builtin_Array_dense_setelem(JSContext *cx, JSObject *obj, jsint i,
     return OBJ_SET_PROPERTY(cx, obj, INT_TO_JSID(i), &v);
 }
 
+JSString* FASTCALL
+builtin_String_p_substring(JSContext *cx, JSString *str, jsint begin, jsint end)
+{
+    JS_ASSERT(end >= begin);
+    return js_NewDependentString(cx, str, (size_t)begin, (size_t)(end - begin));
+}
+
+JSString* FASTCALL
+builtin_String_p_substring_1(JSContext *cx, JSString *str, jsint begin)
+{
+    jsint end = JSSTRING_LENGTH(str);
+    JS_ASSERT(end >= begin);
+    return js_NewDependentString(cx, str, (size_t)begin, (size_t)(end - begin));
+}
+
 #define LO ARGSIZE_LO
 #define F  ARGSIZE_F
 #define Q  ARGSIZE_Q