Currently, RegExpObject's data is allocated with new() in the constructor. This is a problem in peacekeeper. In that case, the tests repeatedly create very small and simple regexp, and use them only one. Currently, the allocation and destruction of RegExpObjectData take more time than the math() itself.
Created attachment 130938 [details] Patch
I also tried Sunspider but there is no change. While trying this, I also noticed JSNonFinalObject has some spare memory: WriteBarrierBase<Unknown> m_inlineStorage[JSFinalObject_inlineStorageCapacity]; Since I am not familiar with that, I did not abuse it to store anything from RegExp. I don't know if anything could be done there?
(In reply to comment #2) > I also tried Sunspider but there is no change. > > While trying this, I also noticed JSNonFinalObject has some spare memory: > WriteBarrierBase<Unknown> m_inlineStorage[JSFinalObject_inlineStorageCapacity]; > Since I am not familiar with that, I did not abuse it to store anything from RegExp. I don't know if anything could be done there? We used to have a concept of 'anonymous slots', to allocate storage within the object's property storage, but I think that has been removed. ES6 will require support for 'private names', we may be able to use these to store internal values (e.g. the regexp) – once we have a mechanism to support this implemented! Right now, no obvious clean way to use the internal property storage springs to mind.
Committed r110266: <http://trac.webkit.org/changeset/110266>