Some string optimizations:

src/string.js

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 16 matching lines @@
 
 
 // This file relies on the fact that the following declaration has been made
 // in runtime.js:
 // const $String = global.String;
 // const $NaN = 0/0;
 
 
 // Set the String function and constructor.
 %SetCode($String, function(x) {
-  var value = %_ArgumentsLength() == 0 ? '' : ToString(x);
+  var value = %_ArgumentsLength() == 0 ? '' : TO_STRING_INLINE(x);
   if (%_IsConstructCall()) {
     %_SetValueOf(this, value);
   } else {
     return value;
   }
 });
 
 %FunctionSetPrototype($String, new $String());
 
 // ECMA-262 section 15.5.4.2
 function StringToString() {
   if (!IS_STRING(this) && !IS_STRING_WRAPPER(this))
     throw new $TypeError('String.prototype.toString is not generic');
   return %_ValueOf(this);
 }
 
 
 // ECMA-262 section 15.5.4.3
 function StringValueOf() {
   if (!IS_STRING(this) && !IS_STRING_WRAPPER(this))
     throw new $TypeError('String.prototype.valueOf is not generic');
   return %_ValueOf(this);
 }
 
 
 // ECMA-262, section 15.5.4.4
 function StringCharAt(pos) {
   var char_code = %_FastCharCodeAt(this, pos);
   if (!%_IsSmi(char_code)) {
-    var subject = ToString(this);
+    var subject = TO_STRING_INLINE(this);
     var index = TO_INTEGER(pos);
     if (index >= subject.length || index < 0) return "";
     char_code = %StringCharCodeAt(subject, index);
   }
   return %CharFromCode(char_code);
 }
 
 
 // ECMA-262 section 15.5.4.5
 function StringCharCodeAt(pos) {
   var fast_answer = %_FastCharCodeAt(this, pos);
   if (%_IsSmi(fast_answer)) {
     return fast_answer;
   }
-  var subject = ToString(this);
+  var subject = TO_STRING_INLINE(this);
   var index = TO_INTEGER(pos);
   return %StringCharCodeAt(subject, index);
 }
 
 
 // ECMA-262, section 15.5.4.6
 function StringConcat() {
   var len = %_ArgumentsLength();
-  var this_as_string = IS_STRING(this) ? this : ToString(this);
+  var this_as_string = TO_STRING_INLINE(this);
   if (len === 1) {
     return this_as_string + %_Arguments(0);
   }
   var parts = new $Array(len + 1);
   parts[0] = this_as_string;
   for (var i = 0; i < len; i++) {
     var part = %_Arguments(i);
-    parts[i + 1] = IS_STRING(part) ? part : ToString(part);
+    parts[i + 1] = TO_STRING_INLINE(part);
   }
   return %StringBuilderConcat(parts, len + 1, "");
 }
 
 // Match ES3 and Safari
 %FunctionSetLength(StringConcat, 1);
 
 
 // ECMA-262 section 15.5.4.7
 function StringIndexOf(searchString /* position */) {  // length == 1
-  var subject_str = ToString(this);
-  var pattern_str = ToString(searchString);
+  var subject_str = TO_STRING_INLINE(this);
+  var pattern_str = TO_STRING_INLINE(searchString);
   var subject_str_len = subject_str.length;
   var pattern_str_len = pattern_str.length;
   var index = 0;
   if (%_ArgumentsLength() > 1) {
     var arg1 = %_Arguments(1);  // position
     index = TO_INTEGER(arg1);
   }
   if (index < 0) index = 0;
   if (index > subject_str_len) index = subject_str_len;
   if (pattern_str_len + index > subject_str_len) return -1;
   return %StringIndexOf(subject_str, pattern_str, index);
 }
 
 
 // ECMA-262 section 15.5.4.8
 function StringLastIndexOf(searchString /* position */) {  // length == 1
-  var sub = ToString(this);
+  var sub = TO_STRING_INLINE(this);
   var subLength = sub.length;
-  var pat = ToString(searchString);
+  var pat = TO_STRING_INLINE(searchString);
   var patLength = pat.length;
   var index = subLength - patLength;
   if (%_ArgumentsLength() > 1) {
     var position = ToNumber(%_Arguments(1));
     if (!$isNaN(position)) {
       position = TO_INTEGER(position);
       if (position < 0) {
         position = 0;
       }
       if (position + patLength < subLength) {
         index = position
       }
     }
   }
   if (index < 0) {
     return -1;
   }
   return %StringLastIndexOf(sub, pat, index);
 }
 
 
 // ECMA-262 section 15.5.4.9
 //
 // This function is implementation specific.  For now, we do not
 // do anything locale specific.
 function StringLocaleCompare(other) {
   if (%_ArgumentsLength() === 0) return 0;
 
-  var this_str = ToString(this);
-  var other_str = ToString(other);
+  var this_str = TO_STRING_INLINE(this);
+  var other_str = TO_STRING_INLINE(other);
   return %StringLocaleCompare(this_str, other_str);
 }
 
 
 // ECMA-262 section 15.5.4.10
 function StringMatch(regexp) {
   if (!IS_REGEXP(regexp)) regexp = new ORIGINAL_REGEXP(regexp);
-  var subject = ToString(this);
+  var subject = TO_STRING_INLINE(this);
 
   if (!regexp.global) return regexp.exec(subject);
   %_Log('regexp', 'regexp-match,%0S,%1r', [subject, regexp]);
   // lastMatchInfo is defined in regexp-delay.js.
   return %StringMatch(subject, regexp, lastMatchInfo);
 }
 
 
 // SubString is an internal function that returns the sub string of 'string'.
 // If resulting string is of length 1, we use the one character cache
@@ skipping 14 matching lines @@
 // This has the same size as the lastMatchInfo array, and can be used for
 // functions that expect that structure to be returned.  It is used when the
 // needle is a string rather than a regexp.  In this case we can't update
 // lastMatchArray without erroneously affecting the properties on the global
 // RegExp object.
 var reusableMatchInfo = [2, "", "", -1, -1];
 
 
 // ECMA-262, section 15.5.4.11
 function StringReplace(search, replace) {
-  var subject = IS_STRING(this) ? this : ToString(this);
+  var subject = TO_STRING_INLINE(this);
 
   // Delegate to one of the regular expression variants if necessary.
   if (IS_REGEXP(search)) {
     %_Log('regexp', 'regexp-replace,%0r,%1S', [search, subject]);
     if (IS_FUNCTION(replace)) {
       return StringReplaceRegExpWithFunction(subject, search, replace);
     } else {
       return StringReplaceRegExp(subject, search, replace);
     }
   }
 
   // Convert the search argument to a string and search for it.
-  search = IS_STRING(search) ? search : ToString(search);
+  search = TO_STRING_INLINE(search);
   var start = %StringIndexOf(subject, search, 0);
   if (start < 0) return subject;
   var end = start + search.length;
 
   var builder = new ReplaceResultBuilder(subject);
   // prefix
   builder.addSpecialSlice(0, start);
 
   // Compute the string to replace with.
   if (IS_FUNCTION(replace)) {
     builder.add(replace.call(null, search, start, subject));
   } else {
     reusableMatchInfo[CAPTURE0] = start;
     reusableMatchInfo[CAPTURE1] = end;
-    if (!IS_STRING(replace)) replace = ToString(replace);
+    replace = TO_STRING_INLINE(replace);
     ExpandReplacement(replace, subject, reusableMatchInfo, builder);
   }
 
   // suffix
   builder.addSpecialSlice(end, subject.length);
 
   return builder.generate();
 }
 
 
 // Helper function for regular expressions in String.prototype.replace.
 function StringReplaceRegExp(subject, regexp, replace) {
-  replace = ToString(replace);
+  replace = TO_STRING_INLINE(replace);
   return %StringReplaceRegExpWithString(subject,
                                         regexp,
                                         replace,
                                         lastMatchInfo);
 };
 
 
 // Expand the $-expressions in the string and return a new string with
 // the result.
 function ExpandReplacement(string, subject, matchInfo, builder) {
@@ skipping 200 matching lines @@
   }
   parameters[j] = index;
   parameters[j + 1] = subject;
   return replace.apply(null, parameters);
 }
 
 
 // ECMA-262 section 15.5.4.12
 function StringSearch(re) {
   var regexp = new ORIGINAL_REGEXP(re);
-  var s = ToString(this);
+  var s = TO_STRING_INLINE(this);
   var last_idx = regexp.lastIndex; // keep old lastIndex
   regexp.lastIndex = 0;            // ignore re.global property
   var result = regexp.exec(s);
   regexp.lastIndex = last_idx;     // restore lastIndex
   if (result == null)
     return -1;
   else
     return result.index;
 }
 
 
 // ECMA-262 section 15.5.4.13
 function StringSlice(start, end) {
-  var s = ToString(this);
+  var s = TO_STRING_INLINE(this);
   var s_len = s.length;
   var start_i = TO_INTEGER(start);
   var end_i = s_len;
   if (end !== void 0)
     end_i = TO_INTEGER(end);
 
   if (start_i < 0) {
     start_i += s_len;
     if (start_i < 0)
       start_i = 0;
@@ skipping 14 matching lines @@
   var num_c = end_i - start_i;
   if (num_c < 0)
     num_c = 0;
 
   return SubString(s, start_i, start_i + num_c);
 }
 
 
 // ECMA-262 section 15.5.4.14
 function StringSplit(separator, limit) {
-  var subject = ToString(this);
+  var subject = TO_STRING_INLINE(this);
   limit = (IS_UNDEFINED(limit)) ? 0xffffffff : TO_UINT32(limit);
   if (limit === 0) return [];
 
   // ECMA-262 says that if separator is undefined, the result should
   // be an array of size 1 containing the entire string.  SpiderMonkey
   // and KJS have this behaviour only when no separator is given.  If
   // undefined is explicitly given, they convert it to a string and
   // use that.  We do as SpiderMonkey and KJS.
   if (%_ArgumentsLength() === 0) {
     return [subject];
   }
 
   var length = subject.length;
-  if (IS_REGEXP(separator)) {
-    %_Log('regexp', 'regexp-split,%0S,%1r', [subject, separator]);
-  } else {
-    separator = ToString(separator);
+  if (!IS_REGEXP(separator)) {
+    separator = TO_STRING_INLINE(separator);
+    var separator_length = separator.length;
+
     // If the separator string is empty then return the elements in the subject.
-    if (separator.length == 0) {
+    if (separator_length === 0) {
       var result = $Array(length);
       for (var i = 0; i < length; i++) result[i] = subject[i];
       return result;
     }
+
+    var result = [];
+    var start_index = 0;
+    var index;
+    while (true) {
+      if (start_index + separator_length > length ||
+          (index = %StringIndexOf(subject, separator, start_index)) === -1) {
+        result.push(SubString(subject, start_index, length));
+        break;
+      }
+      if (result.push(SubString(subject, start_index, index)) === limit) break;
+      start_index = index + separator_length;
+    }
+
+    return result;
   }
 
+  %_Log('regexp', 'regexp-split,%0S,%1r', [subject, separator]);
+
   if (length === 0) {
     if (splitMatch(separator, subject, 0, 0) != null) return [];
     return [subject];
   }
 
   var currentIndex = 0;
   var startIndex = 0;
   var result = [];
 
   while (true) {
@@ skipping 14 matching lines @@
 
     // We ignore a zero-length match at the currentIndex.
     if (startIndex === endIndex && endIndex === currentIndex) {
       startIndex++;
       continue;
     }
 
     result[result.length] = SubString(subject, currentIndex, matchInfo[CAPTURE0]);
     if (result.length === limit) return result;
 
-    for (var i = 2; i < NUMBER_OF_CAPTURES(matchInfo); i += 2) {
+    var num_captures = NUMBER_OF_CAPTURES(matchInfo);
+    for (var i = 2; i < num_captures; i += 2) {
       var start = matchInfo[CAPTURE(i)];
       var end = matchInfo[CAPTURE(i + 1)];
       if (start != -1 && end != -1) {
         result[result.length] = SubString(subject, start, end);
       } else {
         result[result.length] = void 0;
       }
       if (result.length === limit) return result;
     }
 
     startIndex = currentIndex = endIndex;
   }
 }
 
 
 // ECMA-262 section 15.5.4.14
 // Helper function used by split.  This version returns the matchInfo
 // instead of allocating a new array with basically the same information.
 function splitMatch(separator, subject, current_index, start_index) {
-  if (IS_REGEXP(separator)) {
-    var matchInfo = DoRegExpExec(separator, subject, start_index);
-    if (matchInfo == null) return null;
-    // Section 15.5.4.14 paragraph two says that we do not allow zero length
-    // matches at the end of the string.
-    if (matchInfo[CAPTURE0] === subject.length) return null;
-    return matchInfo;
-  }
-
-  var separatorIndex = subject.indexOf(separator, start_index);
-  if (separatorIndex === -1) return null;
-
-  reusableMatchInfo[CAPTURE0] = separatorIndex;
-  reusableMatchInfo[CAPTURE1] = separatorIndex + separator.length;
-  return reusableMatchInfo;
-};
+  var matchInfo = DoRegExpExec(separator, subject, start_index);
+  if (matchInfo == null) return null;
+  // Section 15.5.4.14 paragraph two says that we do not allow zero length
+  // matches at the end of the string.
+  if (matchInfo[CAPTURE0] === subject.length) return null;
+  return matchInfo;
+}
 
 
 // ECMA-262 section 15.5.4.15
 function StringSubstring(start, end) {
-  var s = this;
-  if (!IS_STRING(s)) s = ToString(s);
+  var s = TO_STRING_INLINE(this);
   var s_len = s.length;
 
   var start_i = TO_INTEGER(start);
   if (start_i < 0) {
     start_i = 0;
   } else if (start_i > s_len) {
     start_i = s_len;
   }
 
   var end_i = s_len;
@@ skipping 10 matching lines @@
       }
     }
   }
 
   return SubString(s, start_i, end_i);
 }
 
 
 // This is not a part of ECMA-262.
 function StringSubstr(start, n) {
-  var s = ToString(this);
+  var s = TO_STRING_INLINE(this);
   var len;
 
   // Correct n: If not given, set to string length; if explicitly
   // set to undefined, zero, or negative, returns empty string.
   if (n === void 0) {
     len = s.length;
   } else {
     len = TO_INTEGER(n);
     if (len <= 0) return '';
   }
@@ skipping 17 matching lines @@
 
   var end = start + len;
   if (end > s.length) end = s.length;
 
   return SubString(s, start, end);
 }
 
 
 // ECMA-262, 15.5.4.16
 function StringToLowerCase() {
-  return %StringToLowerCase(ToString(this));
+  return %StringToLowerCase(TO_STRING_INLINE(this));
 }
 
 
 // ECMA-262, 15.5.4.17
 function StringToLocaleLowerCase() {
-  return %StringToLowerCase(ToString(this));
+  return %StringToLowerCase(TO_STRING_INLINE(this));
 }
 
 
 // ECMA-262, 15.5.4.18
 function StringToUpperCase() {
-  return %StringToUpperCase(ToString(this));
+  return %StringToUpperCase(TO_STRING_INLINE(this));
 }
 
 
 // ECMA-262, 15.5.4.19
 function StringToLocaleUpperCase() {
-  return %StringToUpperCase(ToString(this));
+  return %StringToUpperCase(TO_STRING_INLINE(this));
 }
 
 // ES5, 15.5.4.20
 function StringTrim() {
-  return %StringTrim(ToString(this), true, true);
+  return %StringTrim(TO_STRING_INLINE(this), true, true);
 }
 
 function StringTrimLeft() {
-  return %StringTrim(ToString(this), true, false);
+  return %StringTrim(TO_STRING_INLINE(this), true, false);
 }
 
 function StringTrimRight() {
-  return %StringTrim(ToString(this), false, true);
+  return %StringTrim(TO_STRING_INLINE(this), false, true);
 }
 
 // ECMA-262, section 15.5.3.2
 function StringFromCharCode(code) {
   var n = %_ArgumentsLength();
   if (n == 1) return %CharFromCode(ToNumber(code) & 0xffff)
 
   // NOTE: This is not super-efficient, but it is necessary because we
   // want to avoid converting to numbers from within the virtual
   // machine. Maybe we can find another way of doing this?
   var codes = new $Array(n);
   for (var i = 0; i < n; i++) codes[i] = ToNumber(%_Arguments(i));
   return %StringFromCharCodeArray(codes);
 }
 
 
 // Helper function for very basic XSS protection.
 function HtmlEscape(str) {
-  return ToString(str).replace(/</g, "&lt;")
-                      .replace(/>/g, "&gt;")
-                      .replace(/"/g, "&quot;")
-                      .replace(/'/g, "&#039;");
+  return TO_STRING_INLINE(str).replace(/</g, "&lt;")
+                              .replace(/>/g, "&gt;")
+                              .replace(/"/g, "&quot;")
+                              .replace(/'/g, "&#039;");
 };
 
 
 // Compatibility support for KJS.
 // Tested by mozilla/js/tests/js1_5/Regress/regress-276103.js.
 function StringLink(s) {
   return "<a href=\"" + HtmlEscape(s) + "\">" + this + "</a>";
 }
 
 
@@ skipping 58 matching lines @@
 
 
 // ReplaceResultBuilder support.
 function ReplaceResultBuilder(str) {
   this.elements = new $Array();
   this.special_string = str;
 }
 
 
 ReplaceResultBuilder.prototype.add = function(str) {
-  if (!IS_STRING(str)) str = ToString(str);
+  str = TO_STRING_INLINE(str);
   if (str.length > 0) {
     var elements = this.elements;
     elements[elements.length] = str;
   }
 }
 
 
 ReplaceResultBuilder.prototype.addSpecialSlice = function(start, end) {
   var len = end - start;
   if (len == 0) return;
@@ skipping 69 matching lines @@
     "small", StringSmall,
     "strike", StringStrike,
     "sub", StringSub,
     "sup", StringSup,
     "toJSON", StringToJSON
   ));
 }
 
 
 SetupString();