Inline JSCell::toObject() as it shows on some Speedometer profiles.
Created attachment 296687 [details] Patch
Comment on attachment 296687 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=296687&action=review r=me > Source/JavaScriptCore/runtime/JSCellInlines.h:347 > +inline JSObject* JSCell::toObject(ExecState* exec, JSGlobalObject* globalObject) const > +{ > + if (isString()) > + return static_cast<const JSString*>(this)->toObject(exec, globalObject); > + if (isSymbol()) > + return static_cast<const Symbol*>(this)->toObject(exec, globalObject); > + ASSERT(isObject()); > + return jsCast<JSObject*>(const_cast<JSCell*>(this)); > +} I think you might get an even better outcome if you made a toObjectSlowCase that covered string and symbol. That way, the inline path is just one branch on isObject, and then it produces an object.
Comment on attachment 296687 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=296687&action=review >> Source/JavaScriptCore/runtime/JSCellInlines.h:347 >> +} > > I think you might get an even better outcome if you made a toObjectSlowCase that covered string and symbol. That way, the inline path is just one branch on isObject, and then it produces an object. Good point, let me do this instead.
Created attachment 296704 [details] Patch
Comment on attachment 296704 [details] Patch r=me
Comment on attachment 296704 [details] Patch Clearing flags on attachment: 296704 Committed r209636: <http://trac.webkit.org/changeset/209636>
All reviewed patches have been landed. Closing bug.