These can all be de-virtualized by augmenting JSType with additional types.
Created attachment 112732 [details] Patch
Comment on attachment 112732 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=112732&action=review Seems like TypeInfo should eventually move to being specified in ClassInfo, even if a copy is cached in Structure. More elegant to specify TypeInfo declaratively, instead of through a bunch of function call arguments. > Source/JavaScriptCore/runtime/JSType.h:47 > + // VariableObjectType must be greater than all of the types of its subclasses. Less than!
Committed r98747: <http://trac.webkit.org/changeset/98747>