De-virtualize JSCell::toThisObject

https://bugs.webkit.org/show_bug.cgi?id=70958

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Converted all instances of toThisObject to static functions,
added toThisObject to the MethodTable, and replaced all call sites
with a corresponding lookup in the MethodTable.

* API/JSContextRef.cpp:
* JavaScriptCore.exp:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
* runtime/ClassInfo.h:
* runtime/JSActivation.cpp:
(JSC::JSActivation::toThisObject):
* runtime/JSActivation.h:
* runtime/JSCell.cpp:
(JSC::JSCell::toThisObject):
* runtime/JSCell.h:
* runtime/JSObject.cpp:
(JSC::JSObject::put):
(JSC::JSObject::toThisObject):
* runtime/JSObject.h:
(JSC::JSValue::toThisObject):
* runtime/JSStaticScopeObject.cpp:
(JSC::JSStaticScopeObject::toThisObject):
* runtime/JSStaticScopeObject.h:
* runtime/JSString.cpp:
(JSC::JSString::toThisObject):
* runtime/JSString.h:
* runtime/StrictEvalActivation.cpp:
(JSC::StrictEvalActivation::toThisObject):
* runtime/StrictEvalActivation.h:

Source/WebCore:

No new tests.

Converted all instances of toThisObject to static functions,
added toThisObject to the MethodTable, and replaced all call sites
with a corresponding lookup in the MethodTable.

* bindings/js/JSDOMWindowBase.cpp:
(WebCore::JSDOMWindowBase::toThisObject):
* bindings/js/JSDOMWindowBase.h:
* bindings/js/JSErrorHandler.cpp:
(WebCore::JSErrorHandler::handleEvent):
* bridge/NP_jsobject.cpp:
(_NPN_Invoke):
* bridge/qt/qt_runtime.cpp:
(JSC::Bindings::QtRuntimeConnectionMethod::call):

Source/WebKit/mac:

Converted all instances of toThisObject to static functions,
added toThisObject to the MethodTable, and replaced all call sites
with a corresponding lookup in the MethodTable.

* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
(WebKit::NetscapePluginInstanceProxy::invoke):
(WebKit::NetscapePluginInstanceProxy::invokeDefault):

Source/WebKit2:

Converted all instances of toThisObject to static functions,
added toThisObject to the MethodTable, and replaced all call sites
with a corresponding lookup in the MethodTable.

* WebProcess/Plugins/Netscape/NPJSObject.cpp:
(WebKit::NPJSObject::invoke):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@98593 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/API/JSContextRef.cpp b/Source/JavaScriptCore/API/JSContextRef.cpp
index b523e0e..71cb1ab 100644 (file)
--- a/Source/JavaScriptCore/API/JSContextRef.cpp
+++ b/Source/JavaScriptCore/API/JSContextRef.cpp
@@ -163,7 +163,7 @@ JSObjectRef JSContextGetGlobalObject(JSContextRef ctx)
     APIEntryShim entryShim(exec);
 
     // It is necessary to call toThisObject to get the wrapper object when used with WebCore.
-    return toRef(exec->lexicalGlobalObject()->toThisObject(exec));
+    return toRef(exec->lexicalGlobalObject()->methodTable()->toThisObject(exec->lexicalGlobalObject(), exec));
 }
 
 JSContextGroupRef JSContextGetGroup(JSContextRef ctx)

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 1557238..4ff47fa 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,39 @@
+2011-10-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSCell::toThisObject
+        https://bugs.webkit.org/show_bug.cgi?id=70958
+
+        Reviewed by Geoffrey Garen.
+
+        Converted all instances of toThisObject to static functions, 
+        added toThisObject to the MethodTable, and replaced all call sites
+        with a corresponding lookup in the MethodTable.
+
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/ClassInfo.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::toThisObject):
+        * runtime/JSActivation.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toThisObject):
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::toThisObject):
+        * runtime/JSObject.h:
+        (JSC::JSValue::toThisObject):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::toThisObject):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::toThisObject):
+        * runtime/JSString.h:
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::toThisObject):
+        * runtime/StrictEvalActivation.h:
+
 2011-10-27  Yuqiang Xian  <yuqiang.xian@intel.com>
 
         Fix a small bug in callOperation after r98431

diff --git a/Source/JavaScriptCore/JavaScriptCore.exp b/Source/JavaScriptCore/JavaScriptCore.exp
index ed7e217..9db35ef 100644 (file)
--- a/Source/JavaScriptCore/JavaScriptCore.exp
+++ b/Source/JavaScriptCore/JavaScriptCore.exp
@@ -305,6 +305,7 @@ __ZN3JSC8JSObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPS0_j
 __ZN3JSC8JSObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPS0_j
 __ZN3JSC8JSObject12lookupGetterEPNS_9ExecStateERKNS_10IdentifierE
 __ZN3JSC8JSObject12lookupSetterEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSC8JSObject12toThisObjectEPNS_6JSCellEPNS_9ExecStateE
 __ZN3JSC8JSObject13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
 __ZN3JSC8JSObject14deletePropertyEPNS_6JSCellEPNS_9ExecStateERKNS_10IdentifierE
 __ZN3JSC8JSObject15unwrappedObjectEv
@@ -550,7 +551,6 @@ __ZNK3JSC18PropertyDescriptor6setterEv
 __ZNK3JSC18PropertyDescriptor8writableEv
 __ZNK3JSC19SourceProviderCache8byteSizeEv
 __ZNK3JSC6JSCell11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
-__ZNK3JSC6JSCell12toThisObjectEPNS_9ExecStateE
 __ZNK3JSC6JSCell8toNumberEPNS_9ExecStateE
 __ZNK3JSC6JSCell8toObjectEPNS_9ExecStateEPNS_14JSGlobalObjectE
 __ZNK3JSC6JSCell8toStringEPNS_9ExecStateE
@@ -569,7 +569,6 @@ __ZNK3JSC7UString5asciiEv
 __ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateERKNS_10IdentifierE
 __ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateEj
 __ZNK3JSC8JSObject12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
-__ZNK3JSC8JSObject12toThisObjectEPNS_9ExecStateE
 __ZNK3JSC8JSObject8toNumberEPNS_9ExecStateE
 __ZNK3JSC8JSObject8toStringEPNS_9ExecStateE
 __ZNK3JSC8JSObject9classNameEv

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index 020bff8..4180f8d 100644 (file)
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -342,9 +342,6 @@ EXPORTS
     ?toString@JSObject@JSC@@QBE?AVUString@2@PAVExecState@2@@Z
     ?toStringDecimal@DecimalNumber@WTF@@QBEIPA_WI@Z
     ?toStringExponential@DecimalNumber@WTF@@QBEIPA_WI@Z
-    ?toThisObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
-    ?toThisObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
-    ?toThisObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
     ?toThisObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
     ?toUInt32@Identifier@JSC@@SAIABVUString@2@AA_N@Z
     ?tryFastCalloc@WTF@@YA?AUTryMallocReturnValue@1@II@Z

diff --git a/Source/JavaScriptCore/runtime/ClassInfo.h b/Source/JavaScriptCore/runtime/ClassInfo.h
index bfffd78..95ecf46 100644 (file)
--- a/Source/JavaScriptCore/runtime/ClassInfo.h
+++ b/Source/JavaScriptCore/runtime/ClassInfo.h
@@ -58,6 +58,9 @@ namespace JSC {
 
         typedef bool (*GetOwnPropertySlotByIndexFunctionPtr)(JSCell*, ExecState*, unsigned, PropertySlot&);
         GetOwnPropertySlotByIndexFunctionPtr getOwnPropertySlotByIndex;
+
+        typedef JSObject* (*ToThisObjectFunctionPtr)(JSCell*, ExecState*);
+        ToThisObjectFunctionPtr toThisObject;
     };
 
 #define CREATE_METHOD_TABLE(ClassName) { \
@@ -70,6 +73,7 @@ namespace JSC {
         &ClassName::deletePropertyByIndex, \
         &ClassName::getOwnPropertySlot, \
         &ClassName::getOwnPropertySlotByIndex, \
+        &ClassName::toThisObject, \
     }, \
     sizeof(ClassName)
 

diff --git a/Source/JavaScriptCore/runtime/JSActivation.cpp b/Source/JavaScriptCore/runtime/JSActivation.cpp
index 0555dc2..7f4ed9b 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSActivation.cpp
+++ b/Source/JavaScriptCore/runtime/JSActivation.cpp
@@ -203,7 +203,7 @@ bool JSActivation::deleteProperty(JSCell* cell, ExecState* exec, const Identifie
     return Base::deleteProperty(cell, exec, propertyName);
 }
 
-JSObject* JSActivation::toThisObject(ExecState* exec) const
+JSObject* JSActivation::toThisObject(JSCell*, ExecState* exec)
 {
     return exec->globalThisValue();
 }

diff --git a/Source/JavaScriptCore/runtime/JSActivation.h b/Source/JavaScriptCore/runtime/JSActivation.h
index 0c2b855..3977b6f 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSActivation.h
+++ b/Source/JavaScriptCore/runtime/JSActivation.h
@@ -69,7 +69,7 @@ namespace JSC {
         virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
         static bool deleteProperty(JSCell*, ExecState*, const Identifier& propertyName);
 
-        virtual JSObject* toThisObject(ExecState*) const;
+        static JSObject* toThisObject(JSCell*, ExecState*);
 
         void copyRegisters(JSGlobalData&);
         

diff --git a/Source/JavaScriptCore/runtime/JSCell.cpp b/Source/JavaScriptCore/runtime/JSCell.cpp
index 494a11d..11aec34 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSCell.cpp
+++ b/Source/JavaScriptCore/runtime/JSCell.cpp
@@ -112,9 +112,9 @@ bool JSCell::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned ident
     return thisObject->methodTable()->deletePropertyByIndex(thisObject, exec, identifier);
 }
 
-JSObject* JSCell::toThisObject(ExecState* exec) const
+JSObject* JSCell::toThisObject(JSCell* cell, ExecState* exec)
 {
-    return toObject(exec, exec->lexicalGlobalObject());
+    return cell->toObject(exec, exec->lexicalGlobalObject());
 }
 
 JSValue JSCell::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const

diff --git a/Source/JavaScriptCore/runtime/JSCell.h b/Source/JavaScriptCore/runtime/JSCell.h
index 89466b7..830e7ca 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSCell.h
+++ b/Source/JavaScriptCore/runtime/JSCell.h
@@ -96,7 +96,7 @@ namespace JSC {
         static bool deleteProperty(JSCell*, ExecState*, const Identifier& propertyName);
         static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
 
-        virtual JSObject* toThisObject(ExecState*) const;
+        static JSObject* toThisObject(JSCell*, ExecState*);
 
         void* vptr() const { ASSERT(!isZapped()); return *reinterpret_cast<void* const*>(this); }
         void setVPtr(void* vptr) { *reinterpret_cast<void**>(this) = vptr; ASSERT(!isZapped()); }
@@ -295,11 +295,6 @@ namespace JSC {
         return isCell() ? asCell()->toObject(exec, globalObject) : toObjectSlowCase(exec, globalObject);
     }
 
-    inline JSObject* JSValue::toThisObject(ExecState* exec) const
-    {
-        return isCell() ? asCell()->toThisObject(exec) : toThisObjectSlowCase(exec);
-    }
-
     template <typename T> void* allocateCell(Heap& heap)
     {
 #if ENABLE(GC_VALIDATION)

diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index bc67ae1..f5cc8d3 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -173,7 +173,7 @@ void JSObject::put(JSCell* cell, ExecState* exec, const Identifier& propertyName
                 args.append(value);
 
                 // If this is WebCore's global object then we need to substitute the shell.
-                call(exec, setterFunc, callType, callData, thisObject->toThisObject(exec), args);
+                call(exec, setterFunc, callType, callData, thisObject->methodTable()->toThisObject(thisObject, exec), args);
                 return;
             }
 
@@ -557,9 +557,9 @@ UString JSObject::toString(ExecState* exec) const
     return primitive.toString(exec);
 }
 
-JSObject* JSObject::toThisObject(ExecState*) const
+JSObject* JSObject::toThisObject(JSCell* cell, ExecState*)
 {
-    return const_cast<JSObject*>(this);
+    return static_cast<JSObject*>(cell);
 }
 
 JSObject* JSObject::unwrappedObject()

diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 7fda86b..9169cf1 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -135,7 +135,7 @@ namespace JSC {
         double toNumber(ExecState*) const;
         UString toString(ExecState*) const;
 
-        virtual JSObject* toThisObject(ExecState*) const;
+        static JSObject* toThisObject(JSCell*, ExecState*);
         virtual JSObject* unwrappedObject();
 
         bool getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificFunction) const;
@@ -499,6 +499,11 @@ inline bool JSValue::inherits(const ClassInfo* classInfo) const
     return isCell() && asCell()->inherits(classInfo);
 }
 
+inline JSObject* JSValue::toThisObject(ExecState* exec) const
+{
+    return isCell() ? asCell()->methodTable()->toThisObject(asCell(), exec) : toThisObjectSlowCase(exec);
+}
+
 ALWAYS_INLINE bool JSObject::inlineGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     if (WriteBarrierBase<Unknown>* location = getDirectLocation(exec->globalData(), propertyName)) {

diff --git a/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp b/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
index 360a6be..06f8655 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
@@ -44,7 +44,7 @@ void JSStaticScopeObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
     visitor.append(&thisObject->m_registerStore);
 }
 
-JSObject* JSStaticScopeObject::toThisObject(ExecState* exec) const
+JSObject* JSStaticScopeObject::toThisObject(JSCell*, ExecState* exec)
 {
     return exec->globalThisValue();
 }

diff --git a/Source/JavaScriptCore/runtime/JSStaticScopeObject.h b/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
index 4d2a869..3c5942a 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -43,7 +43,7 @@ namespace JSC{
 
         static void visitChildren(JSCell*, SlotVisitor&);
         bool isDynamicScope(bool& requiresDynamicChecks) const;
-        virtual JSObject* toThisObject(ExecState*) const;
+        static JSObject* toThisObject(JSCell*, ExecState*);
         static bool getOwnPropertySlot(JSCell*, ExecState*, const Identifier&, PropertySlot&);
         static void put(JSCell*, ExecState*, const Identifier&, JSValue, PutPropertySlot&);
 

diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index 53e2d3b..f570634 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -196,9 +196,9 @@ JSObject* JSString::toObject(ExecState* exec, JSGlobalObject* globalObject) cons
     return StringObject::create(exec, globalObject, const_cast<JSString*>(this));
 }
 
-JSObject* JSString::toThisObject(ExecState* exec) const
+JSObject* JSString::toThisObject(JSCell* cell, ExecState* exec)
 {
-    return StringObject::create(exec, exec->lexicalGlobalObject(), const_cast<JSString*>(this));
+    return StringObject::create(exec, exec->lexicalGlobalObject(), static_cast<JSString*>(cell));
 }
 
 bool JSString::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)

diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index b6f3db9..097b491 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -247,7 +247,7 @@ namespace JSC {
         void resolveRopeSlowCase(ExecState*, UChar*) const;
         void outOfMemory(ExecState*) const;
 
-        virtual JSObject* toThisObject(ExecState*) const;
+        static JSObject* toThisObject(JSCell*, ExecState*);
 
         // Actually getPropertySlot, not getOwnPropertySlot (see JSCell).
         static bool getOwnPropertySlot(JSCell*, ExecState*, const Identifier& propertyName, PropertySlot&);

diff --git a/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp b/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp
index ce9de5a..21283db 100644 (file)
--- a/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp
+++ b/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp
@@ -40,7 +40,7 @@ bool StrictEvalActivation::deleteProperty(JSCell*, ExecState*, const Identifier&
     return false;
 }
 
-JSObject* StrictEvalActivation::toThisObject(ExecState* exec) const
+JSObject* StrictEvalActivation::toThisObject(JSCell*, ExecState* exec)
 {
     return exec->globalThisValue();
 }

diff --git a/Source/JavaScriptCore/runtime/StrictEvalActivation.h b/Source/JavaScriptCore/runtime/StrictEvalActivation.h
index 0974468..bb70352 100644 (file)
--- a/Source/JavaScriptCore/runtime/StrictEvalActivation.h
+++ b/Source/JavaScriptCore/runtime/StrictEvalActivation.h
@@ -42,7 +42,7 @@ public:
     }
 
     static bool deleteProperty(JSCell*, ExecState*, const Identifier&);
-    virtual JSObject* toThisObject(ExecState*) const;
+    static JSObject* toThisObject(JSCell*, ExecState*);
 
     static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)
     {

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 27c31bf..e953cd5 100755 (executable)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,26 @@
+2011-10-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSCell::toThisObject
+        https://bugs.webkit.org/show_bug.cgi?id=70958
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests.
+
+        Converted all instances of toThisObject to static functions, 
+        added toThisObject to the MethodTable, and replaced all call sites
+        with a corresponding lookup in the MethodTable.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::toThisObject):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSErrorHandler.cpp:
+        (WebCore::JSErrorHandler::handleEvent):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_Invoke):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+
 2011-10-27  Adam Roben  <aroben@apple.com>
 
         Windows build fix after r98512

diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
index d50a0a2..2d31520 100644 (file)
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -145,9 +145,9 @@ void JSDOMWindowBase::willRemoveFromWindowShell()
     setCurrentEvent(0);
 }
 
-JSObject* JSDOMWindowBase::toThisObject(ExecState*) const
+JSObject* JSDOMWindowBase::toThisObject(JSCell* cell, ExecState*)
 {
-    return shell();
+    return static_cast<JSDOMWindowBase*>(cell)->shell();
 }
 
 JSDOMWindowShell* JSDOMWindowBase::shell() const

diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.h b/Source/WebCore/bindings/js/JSDOMWindowBase.h
index 9e9a67b..c55e23c 100644 (file)
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.h
@@ -68,7 +68,7 @@ namespace WebCore {
         // Don't call this version of allowsAccessFrom -- it's a slightly incorrect implementation used only by WebScriptObject
         virtual bool allowsAccessFrom(const JSC::JSGlobalObject*) const;
         
-        virtual JSC::JSObject* toThisObject(JSC::ExecState*) const;
+        static JSC::JSObject* toThisObject(JSC::JSCell*, JSC::ExecState*);
         JSDOMWindowShell* shell() const;
 
         static JSC::JSGlobalData* commonJSGlobalData();

diff --git a/Source/WebCore/bindings/js/JSErrorHandler.cpp b/Source/WebCore/bindings/js/JSErrorHandler.cpp
index 01ec6b7..59b3ff3 100644 (file)
--- a/Source/WebCore/bindings/js/JSErrorHandler.cpp
+++ b/Source/WebCore/bindings/js/JSErrorHandler.cpp
@@ -91,7 +91,7 @@ void JSErrorHandler::handleEvent(ScriptExecutionContext* scriptExecutionContext,
         JSGlobalData& globalData = globalObject->globalData();
         DynamicGlobalObjectScope globalObjectScope(globalData, globalData.dynamicGlobalObject ? globalData.dynamicGlobalObject : globalObject);
 
-        JSValue thisValue = globalObject->toThisObject(exec);
+        JSValue thisValue = globalObject->methodTable()->toThisObject(globalObject, exec);
 
         globalData.timeoutChecker.start();
         JSValue returnValue = JSC::call(exec, jsFunction, callType, callData, thisValue, args);

diff --git a/Source/WebCore/bridge/NP_jsobject.cpp b/Source/WebCore/bridge/NP_jsobject.cpp
index 5922133..0bc187b 100644 (file)
--- a/Source/WebCore/bridge/NP_jsobject.cpp
+++ b/Source/WebCore/bridge/NP_jsobject.cpp
@@ -241,7 +241,7 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         RefPtr<JSGlobalData> globalData(&exec->globalData());
         globalData->timeoutChecker.start();
-        JSValue resultV = JSC::call(exec, function, callType, callData, obj->imp->toThisObject(exec), argList);
+        JSValue resultV = JSC::call(exec, function, callType, callData, obj->imp->methodTable()->toThisObject(obj->imp, exec), argList);
         globalData->timeoutChecker.stop();
 
         // Convert and return the result of the function call.

diff --git a/Source/WebCore/bridge/qt/qt_runtime.cpp b/Source/WebCore/bridge/qt/qt_runtime.cpp
index afbbc7a..24467bf 100644 (file)
--- a/Source/WebCore/bridge/qt/qt_runtime.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime.cpp
@@ -1605,7 +1605,7 @@ EncodedJSValue QtRuntimeConnectionMethod::call(ExecState* exec)
 
     if (sender) {
 
-        JSObject* thisObject = exec->lexicalGlobalObject()->toThisObject(exec);
+        JSObject* thisObject = exec->lexicalGlobalObject()->methodTable()->toThisObject(exec->lexicalGlobalObject(), exec);
         JSObject* funcObject = 0;
 
         // QtScript checks signalness first, arguments second

diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index 5263fd0..a8e9822 100644 (file)
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,18 @@
+2011-10-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSCell::toThisObject
+        https://bugs.webkit.org/show_bug.cgi?id=70958
+
+        Reviewed by Geoffrey Garen.
+
+        Converted all instances of toThisObject to static functions, 
+        added toThisObject to the MethodTable, and replaced all call sites
+        with a corresponding lookup in the MethodTable.
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::invoke):
+        (WebKit::NetscapePluginInstanceProxy::invokeDefault):
+
 2011-10-25  Mark Hahnenberg  <mhahnenberg@apple.com>
 
         Remove deletePropertyVirtual

diff --git a/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm b/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
index e81078e..937431c 100644 (file)
--- a/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
+++ b/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
@@ -916,7 +916,7 @@ bool NetscapePluginInstanceProxy::invoke(uint32_t objectID, const Identifier& me
 
     RefPtr<JSGlobalData> globalData = pluginWorld()->globalData();
     globalData->timeoutChecker.start();
-    JSValue value = call(exec, function, callType, callData, object->toThisObject(exec), argList);
+    JSValue value = call(exec, function, callType, callData, object->methodTable()->toThisObject(object, exec), argList);
     globalData->timeoutChecker.stop();
         
     marshalValue(exec, value, resultData, resultLength);
@@ -951,7 +951,7 @@ bool NetscapePluginInstanceProxy::invokeDefault(uint32_t objectID, data_t argume
 
     RefPtr<JSGlobalData> globalData = pluginWorld()->globalData();
     globalData->timeoutChecker.start();
-    JSValue value = call(exec, object, callType, callData, object->toThisObject(exec), argList);
+    JSValue value = call(exec, object, callType, callData, object->methodTable()->toThisObject(object, exec), argList);
     globalData->timeoutChecker.stop();
     
     marshalValue(exec, value, resultData, resultLength);

diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index 9f717cc..e7c6c82 100644 (file)
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,17 @@
+2011-10-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSCell::toThisObject
+        https://bugs.webkit.org/show_bug.cgi?id=70958
+
+        Reviewed by Geoffrey Garen.
+
+        Converted all instances of toThisObject to static functions, 
+        added toThisObject to the MethodTable, and replaced all call sites
+        with a corresponding lookup in the MethodTable.
+
+        * WebProcess/Plugins/Netscape/NPJSObject.cpp:
+        (WebKit::NPJSObject::invoke):
+
 2011-10-27  Adam Roben  <aroben@apple.com>
 
         Add WKBundlePageGetBackingScaleFactor

diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
index c6936dc..ba8fa3d 100644 (file)
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
@@ -291,7 +291,7 @@ bool NPJSObject::invoke(ExecState* exec, JSGlobalObject* globalObject, JSValue f
         argumentList.append(m_objectMap->convertNPVariantToJSValue(exec, globalObject, arguments[i]));
 
     exec->globalData().timeoutChecker.start();
-    JSValue value = JSC::call(exec, function, callType, callData, m_jsObject->toThisObject(exec), argumentList);
+    JSValue value = JSC::call(exec, function, callType, callData, m_jsObject->methodTable()->toThisObject(m_jsObject.get(), exec), argumentList);
     exec->globalData().timeoutChecker.stop();
 
     // Convert and return the result of the function call.