StringProtoFuncReplace::callAsFunction should use vectors for a speedup static JSValue *replace(ExecState *exec, StringImp* sourceVal, JSValue *pattern, JSValue *replacement) Does all its array manipulation by hand. It should use Vector<UString::Range> and Vector<UString> instead (if for no other reason than for the fast copies on expansion). This is what one might call an "easy fix". :)
KJS::replace is 1.4% of the sample for: run-sunspider --shark20 --tests "cube|tagcloud|unpack|spectra"
Created attachment 18070 [details] fix, sunspider is crazy I must have angered the sunspider gods again. SS claims this is a regression on a bunch of unrelated tests.
Looks like this function uses vectors now.