Bug 165679 - Inline JSCell::toObject()
Summary: Inline JSCell::toObject()
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-12-09 13:36 PST by Chris Dumez
Modified: 2016-12-09 15:37 PST (History)
6 users (show)

See Also:


Attachments
Patch (4.61 KB, patch)
2016-12-09 13:37 PST, Chris Dumez
no flags Details | Formatted Diff | Diff
Patch (3.50 KB, patch)
2016-12-09 14:46 PST, Chris Dumez
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2016-12-09 13:36:13 PST
Inline JSCell::toObject() as it shows on some Speedometer profiles.
Comment 1 Chris Dumez 2016-12-09 13:37:48 PST
Created attachment 296687 [details]
Patch
Comment 2 Geoffrey Garen 2016-12-09 13:41:06 PST
Comment on attachment 296687 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=296687&action=review

r=me

> Source/JavaScriptCore/runtime/JSCellInlines.h:347
> +inline JSObject* JSCell::toObject(ExecState* exec, JSGlobalObject* globalObject) const
> +{
> +    if (isString())
> +        return static_cast<const JSString*>(this)->toObject(exec, globalObject);
> +    if (isSymbol())
> +        return static_cast<const Symbol*>(this)->toObject(exec, globalObject);
> +    ASSERT(isObject());
> +    return jsCast<JSObject*>(const_cast<JSCell*>(this));
> +}

I think you might get an even better outcome if you made a toObjectSlowCase that covered string and symbol. That way, the inline path is just one branch on isObject, and then it produces an object.
Comment 3 Chris Dumez 2016-12-09 13:52:54 PST
Comment on attachment 296687 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=296687&action=review

>> Source/JavaScriptCore/runtime/JSCellInlines.h:347
>> +}
> 
> I think you might get an even better outcome if you made a toObjectSlowCase that covered string and symbol. That way, the inline path is just one branch on isObject, and then it produces an object.

Good point, let me do this instead.
Comment 4 Chris Dumez 2016-12-09 14:46:45 PST
Created attachment 296704 [details]
Patch
Comment 5 Geoffrey Garen 2016-12-09 14:59:14 PST
Comment on attachment 296704 [details]
Patch

r=me
Comment 6 WebKit Commit Bot 2016-12-09 15:37:30 PST
Comment on attachment 296704 [details]
Patch

Clearing flags on attachment: 296704

Committed r209636: <http://trac.webkit.org/changeset/209636>
Comment 7 WebKit Commit Bot 2016-12-09 15:37:35 PST
All reviewed patches have been landed.  Closing bug.