Backed out changeset a804ccdfe7c4.

js/src/jsfun.cpp

@@ -80,10 +80,6 @@
 # include "jsxdrapi.h"
 #endif
 
-#ifdef JS_METHODJIT
-#include "methodjit/MethodJIT.h"
-#endif
-
 #include "jsatominlines.h"
 #include "jscntxtinlines.h"
 #include "jsfuninlines.h"
@@ -1118,24 +1114,7 @@ js_PutCallObject(JSContext *cx, JSStackFrame *fp)
     if (n != 0) {
         JS_ASSERT(callobj->numSlots() >= JS_INITIAL_NSLOTS + n);
         n += JS_INITIAL_NSLOTS;
-
-        JSScript *script = fun->u.i.script;
-        uint32 nargs = fun->nargs;
-        uint32 nvars = fun->u.i.nvars;
-
-#ifdef JS_METHODJIT
-        memcpy(callobj->dslots, fp->argv, nargs * sizeof(Value));
-        if (!script->jit || script->usesEval) {
-            memcpy(callobj->dslots + nargs, fp->slots(), nvars * sizeof(Value));
-        } else if (script->jit) {
-            for (uint32 i = 0; i < script->jit->nescaping; i++) {
-                uint32 e = script->jit->escaping[i];
-                callobj->dslots[nargs + e] = fp->slots()[e];
-            }
-        }
-#else
-        CopyValuesToCallObject(callobj, nargs, fp->argv, nvars, fp->slots());
-#endif
+        CopyValuesToCallObject(callobj, fun->nargs, fp->argv, fun->u.i.nvars, fp->slots());
     }
 
     /* Clear private pointers to fp, which is about to go away (js_Invoke). */

js/src/methodjit/Compiler.cpp

@@ -82,7 +82,6 @@ mjit::Compiler::Compiler(JSContext *cx, JSScript *script, JSFunction *fun, JSObj
 #endif
     callSites(ContextAllocPolicy(cx)), 
     doubleList(ContextAllocPolicy(cx)),
-    escapingList(ContextAllocPolicy(cx)),
     stubcc(cx, *this, frame, script)
 #if defined JS_TRACER
     ,addTraceHints(cx->jitEnabled)
@@ -252,7 +251,6 @@ mjit::Compiler::finishThisUp()
     JSC::LinkBuffer stubCode(result + masm.size(), stubcc.size());
 
     size_t totalBytes = sizeof(JITScript) +
-                        sizeof(uint32) * escapingList.length() +
                         sizeof(void *) * script->length +
 #if defined JS_MONOIC
                         sizeof(ic::MICInfo) * mics.length() +
@@ -277,16 +275,6 @@ mjit::Compiler::finishThisUp()
     script->jit->nCallSites = callSites.length();
     script->jit->invoke = result;
 
-    script->jit->nescaping = escapingList.length();
-    if (escapingList.length()) {
-        script->jit->escaping = (uint32 *)cursor;
-        cursor += sizeof(uint32) * escapingList.length();
-        for (uint32 i = 0; i < escapingList.length(); i++)
-            script->jit->escaping[i] = escapingList[i];
-    } else {
-        script->jit->escaping = NULL;
-    }
-
     /* Build the pc -> ncode mapping. */
     void **nmap = (void **)cursor;
     script->nmap = nmap;
@@ -1466,13 +1454,7 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_GLOBALINC)
 
           BEGIN_CASE(JSOP_DEFUPVAR)
-          {
-            uint32 slot = GET_SLOTNO(PC);
-            if (frame.addEscaping(slot) && slot < script->nfixed) {
-                if (!escapingList.append(slot))
-                    return Compile_Error;
-            }
-          }
+            frame.addEscaping(GET_SLOTNO(PC));
           END_CASE(JSOP_DEFUPVAR)
 
           default:

js/src/methodjit/Compiler.h

@@ -190,7 +190,6 @@ class Compiler
 #endif
     js::Vector<InternalCallSite, 64> callSites;
     js::Vector<DoublePatch, 16> doubleList;
-    js::Vector<uint32, 16> escapingList;
     StubCompiler stubcc;
     Label invokeLabel;
     bool addTraceHints;

js/src/methodjit/FrameState-inl.h

@@ -745,15 +745,11 @@ FrameState::eviscerate(FrameEntry *fe)
     fe->setCopyOf(NULL);
 }
 
-inline bool
+inline void
 FrameState::addEscaping(uint32 local)
 {
-    if (!eval) {
-        uint32 already = escaping[local];
+    if (!eval)
         escaping[local] = 1;
-        return !already;
-    }
-    return false;
 }
 
 inline StateRemat

js/src/methodjit/FrameState.h

@@ -655,11 +655,7 @@ class FrameState
      */
     void shift(int32 n);
 
-    /*
-     * Notifies the frame of a slot that can escape. Returns whether or not
-     * the slot was added.
-     */
-    inline bool addEscaping(uint32 local);
+    inline void addEscaping(uint32 local);
 
     inline void setInTryBlock(bool inTryBlock) {
         this->inTryBlock = inTryBlock;

js/src/methodjit/MethodJIT.cpp

@@ -820,8 +820,9 @@ mjit::ReleaseScriptCode(JSContext *cx, JSScript *script)
             Destroy(script->pics[i].execPools);
         }
 #endif
-        cx->free(script->jit);
     }
+
+    cx->free(script->jit);
 }
 
 #ifdef JS_METHODJIT_PROFILE_STUBS

js/src/methodjit/MethodJIT.h

@@ -185,8 +185,6 @@ struct JITScript {
     uint32          nPICs;           /* number of PolyICs */
 #endif
     void            *invoke;         /* invoke address */
-    uint32          *escaping;       /* list of escaping slots */
-    uint32          nescaping;       /* number of escaping slots */
 };
 
 /* Execute a method that has been JIT compiled. */

js/src/trace-test/tests/jaeger/bug590088.js

@@ -1,5 +0,0 @@
-Function("var a=e=(function(){*::*}).prototype")()
-gc()
-
-/* Don't assert/crash. */
-