I found an interesting article on the topic of inline object allocation, in the context of dynamic languages: http://reference.kfupm.edu.sa/content/a/u/automatic_inline_allocation_of_obj...
They use interprocedural dataflow analysis and global program transformation to inline object fields. I find the explanation of their analysis somewhat unclear, but they seem to get good results. We probably don't want to experiment with object inlining anytime soon, but it's good to know it seems to work fairly well in practice.
In the medium term, I think we could work on optimized object representation that can inline booleans, doubles, and integers (numbers found to be int32/uint32), and benefits from type information to remove dynamic checks.
I started writing some type analysis notes on Google docs, which I've been expanding on as I'm reading papers and the JS spec. I believe I've found a way to factor in which fields are defined/undefined inside objects into a type analysis, using a simple 32-bit bit-map to propagate the information around. This way, checks to test which fields are undefined in an object can be individually tailored to each field access point, instead of having to check everywhere.
- Maxime