Bug 68937 – De-virtualize JSCell::toObject

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Hahnenberg]

Part of process of de-virtualizing JSCell.

[Mark Hahnenberg]

Created attachment 108902 [details]
Patch

[Mark Hahnenberg]

Created attachment 109041 [details]
Patch

[Mark Hahnenberg]

Created attachment 109044 [details]
Patch

[Geoffrey Garen]

Comment on attachment 109044 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=109044&action=review

r=me with the change below:

> Source/JavaScriptCore/runtime/JSCell.cpp:158
> +    if (isString())
> +        return static_cast<const JSString*>(this)->toObject(exec, globalObject);
> +    return static_cast<const JSObject*>(this)->toObject(exec, globalObject);

I think it would be better, in the object case, to ASSERT(isObject()) and then static_cast to JSObject*, and remove JSObject::toObject entirely. No need to have that identity function anymore, now that we're not using virtual functions.

[Mark Hahnenberg]

Created attachment 109206 [details]
Patch

[Darin Adler]

Comment on attachment 109206 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=109206&action=review

> Source/JavaScriptCore/runtime/JSCell.cpp:154
> +JSObject* JSCell::toObject(ExecState* exec, JSGlobalObject* globalObject) const

Should we consider inlining this in JSString.h?

[Mark Hahnenberg]

Created attachment 109217 [details]
Benchmark results (without inlining)

[Mark Hahnenberg]

Created attachment 109218 [details]
Benchmark results (with inlining)

[WebKit Review Bot]

Comment on attachment 109206 [details]
Patch

Clearing flags on attachment: 109206

Committed r96381: <http://trac.webkit.org/changeset/96381>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.