[webkit-reviews] review granted: [Bug 54786] Devirtualize JSCell::classInfo() : [Attachment 83045] The patch, this shows a small sunspider regression, but a similar v8 progression - a wash overall.

[bugzilla-daemon at webkit.org]

Sam Weinig <sam at webkit.org> has granted Gavin Barraclough
<barraclough at apple.com>'s request for review:
Bug 54786: Devirtualize JSCell::classInfo()
https://bugs.webkit.org/show_bug.cgi?id=54786

Attachment 83045: The patch, this shows a small sunspider regression, but a
similar v8 progression - a wash overall.
https://bugs.webkit.org/attachment.cgi?id=83045&action=review

------- Additional Comments from Sam Weinig <sam at webkit.org>
View in context: https://bugs.webkit.org/attachment.cgi?id=83045&action=review

> Source/JavaScriptCore/ChangeLog:266
> +	   (JSC::Structure::toDictionaryTransition):
> +	   * runtime/Structure.h:
> +	   (JSC::Structure::create):
> +	   (JSC::Structure::classInfo):
> +

I am not sure how much of this wall of text is really necessary.

> Source/JavaScriptCore/jit/JITOpcodes.cpp:587
> -    Jump notObject = branch8(NotEqual, Address(regT2,
OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)),
Imm32(ObjectType));
> +    Jump notObject = branch8(NotEqual, Address(regT2,
OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType));

This seems unrelated.

> Source/JavaScriptCore/runtime/InternalFunction.cpp:32
> +void InternalFunction::vtableFix()

I like the name vtableAnchor a bit better.

> Source/JavaScriptCore/runtime/JSByteArray.cpp:56
> +    PassRefPtr<Structure> result = Structure::create(prototype,
TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, classInfo);
>      return result;

This should just return directly.