Bug 165679 – Inline JSCell::toObject()

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Chris Dumez]

Inline JSCell::toObject() as it shows on some Speedometer profiles.

[Chris Dumez]

Created attachment 296687 [details]
Patch

[Geoffrey Garen]

Comment on attachment 296687 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=296687&action=review

r=me

> Source/JavaScriptCore/runtime/JSCellInlines.h:347
> +inline JSObject* JSCell::toObject(ExecState* exec, JSGlobalObject* globalObject) const
> +{
> +    if (isString())
> +        return static_cast<const JSString*>(this)->toObject(exec, globalObject);
> +    if (isSymbol())
> +        return static_cast<const Symbol*>(this)->toObject(exec, globalObject);
> +    ASSERT(isObject());
> +    return jsCast<JSObject*>(const_cast<JSCell*>(this));
> +}

I think you might get an even better outcome if you made a toObjectSlowCase that covered string and symbol. That way, the inline path is just one branch on isObject, and then it produces an object.

[Chris Dumez]

Comment on attachment 296687 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=296687&action=review

>> Source/JavaScriptCore/runtime/JSCellInlines.h:347
>> +}
> 
> I think you might get an even better outcome if you made a toObjectSlowCase that covered string and symbol. That way, the inline path is just one branch on isObject, and then it produces an object.

Good point, let me do this instead.

[Chris Dumez]

Created attachment 296704 [details]
Patch

[Geoffrey Garen]

Comment on attachment 296704 [details]
Patch

r=me

[WebKit Commit Bot]

Comment on attachment 296704 [details]
Patch

Clearing flags on attachment: 296704

Committed r209636: <http://trac.webkit.org/changeset/209636>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.