Merge.

js/src/jstracer.cpp

@@ -1282,6 +1282,9 @@ struct FrameInfo {
     };
 };
 
+static void
+js_TrashTree(JSContext* cx, Fragment* f);
+
 /* Promote slots if necessary to match the called tree' type map and report error if thats
    impossible. */
 bool
@@ -1291,23 +1294,36 @@ TraceRecorder::adjustCallerTypes(Fragment* f)
     uint8* m = tm->globalTypeMap->data();
     uint16* gslots = traceMonitor->globalSlots->data();
     unsigned ngslots = traceMonitor->globalSlots->length();
+    JSScript* script = ((TreeInfo*)f->vmprivate)->script;
+    uint8* map = ((TreeInfo*)f->vmprivate)->stackTypeMap.data();
+    bool ok = true;
     FORALL_GLOBAL_SLOTS(cx, ngslots, gslots, 
         LIns* i = get(vp);
         bool isPromote = isPromoteInt(i);
         if (isPromote && *m == JSVAL_DOUBLE) 
             lir->insStorei(get(vp), gp_ins, nativeGlobalOffset(vp));
+        else if (!isPromote && *m == JSVAL_INT) {
+            oracle.markGlobalSlotUndemotable(script, nativeGlobalOffset(vp)/sizeof(double));
+            ok = false;
+        }
         ++m;
     );
-    m = ((TreeInfo*)f->vmprivate)->stackTypeMap.data();
+    m = map;
     FORALL_SLOTS_IN_PENDING_FRAMES(cx, 0,
         LIns* i = get(vp);
         bool isPromote = isPromoteInt(i);
         if (isPromote && *m == JSVAL_DOUBLE) 
             lir->insStorei(get(vp), lirbuf->sp, 
                            -treeInfo->nativeStackBase + nativeStackOffset(vp));
+        else if (!isPromote && *m == JSVAL_INT) {
+            oracle.markStackSlotUndemotable(script, (jsbytecode*)f->ip, unsigned(m - map));
+            ok = false;
+        }
         ++m;
     );
-    return true;
+    if (!ok)
+        js_TrashTree(cx, f);
+    return ok;
 }
 
 /* Find a peer fragment that we can call, considering our current type distribution. */
@@ -1412,9 +1428,6 @@ TraceRecorder::checkType(jsval& v, uint8 t, bool& unstable)
     return JSVAL_TAG(v) == t;
 }
 
-static void
-js_TrashTree(JSContext* cx, Fragment* f);
-
 /* Make sure that the current values in the given stack frame and all stack frames
    up and including entryFrame are type-compatible with the entry map. */
 bool
@@ -1800,6 +1813,7 @@ js_RecordTree(JSContext* cx, JSTraceMonitor* tm, Fragment* f)
             (cx->fp->regs->sp - StackBase(cx->fp))) * sizeof(double);
     ti->maxNativeStackSlots = entryNativeStackSlots;
     ti->maxCallDepth = 0;
+    ti->script = cx->fp->script;
 
     /* recording primary trace */
     return js_StartRecorder(cx, NULL, f, ti,

js/src/jstracer.h

@@ -180,6 +180,7 @@ public:
 class TreeInfo MMGC_SUBCLASS_DECL {
     nanojit::Fragment*      fragment;
 public:
+    JSScript*               script;
     unsigned                maxNativeStackSlots;
     ptrdiff_t               nativeStackBase;
     unsigned                maxCallDepth;

js/src/trace-test.js

@@ -835,6 +835,19 @@ function stringSplitIntoArrayTest()
 stringSplitIntoArrayTest.expected="a,b,a,b,a,b,a,b,a,b,a,b,a,b,a,b,a,b,a,b";
 test(stringSplitIntoArrayTest);
 
+function innerLoopIntOuterDouble() {
+    var n = 10000, i=0, j=0, count=0, limit=0;
+    for (i = 1; i <= n; ++i) {
+	limit = i * 1;
+	for (j = 0; j < limit; ++j) {
+	    ++count;
+	}
+    }
+    return "" + count;
+}
+innerLoopIntOuterDouble.expected="50005000";
+test(innerLoopIntOuterDouble);
+
 /* Keep these at the end so that we can see the summary after the trace-debug spew. */
 print("\npassed:", passes.length && passes.join(","));
 print("\nFAILED:", fails.length && fails.join(","));