Merge

content/canvas/src/CustomQS_WebGL.h

@@ -768,298 +768,3 @@ nsICanvasRenderingContextWebGL_VertexAttrib4fv(JSContext *cx, uintN argc, jsval
 {
     return helper_nsICanvasRenderingContextWebGL_VertexAttrib_x_fv(cx, argc, vp, 4);
 }
-
-#ifdef JS_TRACER
-
-static inline jsval FASTCALL
-helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(JSContext *cx, JSObject *obj, JSObject *locationobj,
-                                                      JSObject *arg, int nElements)
-{
-    XPC_QS_ASSERT_CONTEXT_OK(cx);
-
-    nsICanvasRenderingContextWebGL *self;
-    xpc_qsSelfRef selfref;
-    xpc_qsArgValArray<3> vp(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, &vp.array[0], nsnull)) {
-        js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
-    }
-
-    js::AutoValueRooter obj_tvr(cx);
-
-    nsIWebGLUniformLocation *location;
-    xpc_qsSelfRef location_selfref;
-    nsresult rv_convert_arg0
-        = xpc_qsUnwrapThis(cx, locationobj, nsnull, &location, &location_selfref.ptr, &vp.array[1], nsnull);
-    if (NS_FAILED(rv_convert_arg0)) {
-        js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
-    }
-
-    js::TypedArray *wa = 0;
-
-    if (helper_isInt32Array(arg)) {
-        wa = js::TypedArray::fromJSObject(arg);
-    }  else if (JS_IsArrayObject(cx, arg)) {
-        JSObject *nobj = js_CreateTypedArrayWithArray(cx, js::TypedArray::TYPE_INT32, arg);
-        if (!nobj) {
-            // XXX this will likely return a strange error message if it goes wrong
-            js_SetTraceableNativeFailed(cx);
-            return JSVAL_VOID;
-        }
-
-        *obj_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
-        wa = js::TypedArray::fromJSObject(nobj);
-    } else {
-        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformNiv");
-        js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
-    }
-
-    nsresult rv;
-
-    if (nElements == 1) {
-        rv = self->Uniform1iv_array(location, wa);
-    } else if (nElements == 2) {
-        rv = self->Uniform2iv_array(location, wa);
-    } else if (nElements == 3) {
-        rv = self->Uniform3iv_array(location, wa);
-    } else if (nElements == 4) {
-        rv = self->Uniform4iv_array(location, wa);
-    }
-
-    if (NS_FAILED(rv)) {
-        xpc_qsThrowMethodFailedWithDetails(cx, rv, "nsICanvasRenderingContextWebGL", "uniformNiv");
-        js_SetTraceableNativeFailed(cx);
-    }
-
-    return JSVAL_VOID;
-}
-
-static inline jsval FASTCALL
-helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(JSContext *cx, JSObject *obj, JSObject *locationobj,
-                                                      JSObject *arg, int nElements)
-{
-    XPC_QS_ASSERT_CONTEXT_OK(cx);
-
-    nsICanvasRenderingContextWebGL *self;
-    xpc_qsSelfRef selfref;
-    xpc_qsArgValArray<3> vp(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, &vp.array[0], nsnull)) {
-        js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
-    }
-
-    js::AutoValueRooter obj_tvr(cx);
-
-    nsIWebGLUniformLocation *location;
-    xpc_qsSelfRef location_selfref;
-    nsresult rv_convert_arg0
-        = xpc_qsUnwrapThis(cx, locationobj, nsnull, &location, &location_selfref.ptr, &vp.array[1], nsnull);
-    if (NS_FAILED(rv_convert_arg0)) {
-        js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
-    }
-
-    js::TypedArray *wa = 0;
-
-    if (helper_isFloat32Array(arg)) {
-        wa = js::TypedArray::fromJSObject(arg);
-    }  else if (JS_IsArrayObject(cx, arg)) {
-        JSObject *nobj = js_CreateTypedArrayWithArray(cx, js::TypedArray::TYPE_FLOAT32, arg);
-        if (!nobj) {
-            // XXX this will likely return a strange error message if it goes wrong
-            js_SetTraceableNativeFailed(cx);
-            return JSVAL_VOID;
-        }
-
-        *obj_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
-        wa = js::TypedArray::fromJSObject(nobj);
-    } else {
-        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformNfv");
-        js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
-    }
-
-    nsresult rv;
-
-    if (nElements == 1) {
-        rv = self->Uniform1fv_array(location, wa);
-    } else if (nElements == 2) {
-        rv = self->Uniform2fv_array(location, wa);
-    } else if (nElements == 3) {
-        rv = self->Uniform3fv_array(location, wa);
-    } else if (nElements == 4) {
-        rv = self->Uniform4fv_array(location, wa);
-    }
-
-    if (NS_FAILED(rv)) {
-        xpc_qsThrowMethodFailedWithDetails(cx, rv, "nsICanvasRenderingContextWebGL", "uniformNfv");
-        js_SetTraceableNativeFailed(cx);
-    }
-
-    return JSVAL_VOID;
-}
-
-static inline jsval FASTCALL
-helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(JSContext *cx, JSObject *obj, JSObject *locationobj,
-                                                            JSBool transpose, JSObject *arg, int nElements)
-{
-    XPC_QS_ASSERT_CONTEXT_OK(cx);
-
-    nsICanvasRenderingContextWebGL *self;
-    xpc_qsSelfRef selfref;
-    xpc_qsArgValArray<4> vp(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, &vp.array[0], nsnull)) {
-        js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
-    }
-
-    js::AutoValueRooter obj_tvr(cx);
-
-    nsIWebGLUniformLocation *location;
-    xpc_qsSelfRef location_selfref;
-    nsresult rv_convert_arg0
-        = xpc_qsUnwrapThis(cx, locationobj, nsnull, &location, &location_selfref.ptr, &vp.array[1], nsnull);
-    if (NS_FAILED(rv_convert_arg0)) {
-        js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
-    }
-
-    js::TypedArray *wa = 0;
-
-    if (helper_isFloat32Array(arg)) {
-        wa = js::TypedArray::fromJSObject(arg);
-    }  else if (JS_IsArrayObject(cx, arg)) {
-        JSObject *nobj = js_CreateTypedArrayWithArray(cx, js::TypedArray::TYPE_FLOAT32, arg);
-        if (!nobj) {
-            // XXX this will likely return a strange error message if it goes wrong
-            js_SetTraceableNativeFailed(cx);
-            return JSVAL_VOID;
-        }
-
-        *obj_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
-        wa = js::TypedArray::fromJSObject(nobj);
-    } else {
-        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformMatrixNfv");
-        js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
-    }
-
-    nsresult rv;
-    if (nElements == 2) {
-        rv = self->UniformMatrix2fv_array(location, transpose, wa);
-    } else if (nElements == 3) {
-        rv = self->UniformMatrix3fv_array(location, transpose, wa);
-    } else if (nElements == 4) {
-        rv = self->UniformMatrix4fv_array(location, transpose, wa);
-    }
-
-    if (NS_FAILED(rv)) {
-        xpc_qsThrowMethodFailedWithDetails(cx, rv, "nsICanvasRenderingContextWebGL", "uniformMatrixNfv");
-        js_SetTraceableNativeFailed(cx);
-    }
-
-    return JSVAL_VOID;
-}
-
-static jsval FASTCALL
-nsICanvasRenderingContextWebGL_Uniform1iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
-{
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 1);
-}
-
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform1iv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform1iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
-
-static jsval FASTCALL
-nsICanvasRenderingContextWebGL_Uniform2iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
-{
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 2);
-}
-
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform2iv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform2iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
-
-static jsval FASTCALL
-nsICanvasRenderingContextWebGL_Uniform3iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
-{
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 3);
-}
-
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform3iv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform3iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
-
-static jsval FASTCALL
-nsICanvasRenderingContextWebGL_Uniform4iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
-{
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 4);
-}
-
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform4iv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform4iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
-
-static jsval FASTCALL
-nsICanvasRenderingContextWebGL_Uniform1fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
-{
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 1);
-}
-
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform1fv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform1fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
-
-static jsval FASTCALL
-nsICanvasRenderingContextWebGL_Uniform2fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
-{
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 2);
-}
-
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform2fv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform2fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
-
-static jsval FASTCALL
-nsICanvasRenderingContextWebGL_Uniform3fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
-{
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 3);
-}
-
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform3fv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform3fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
-
-static jsval FASTCALL
-nsICanvasRenderingContextWebGL_Uniform4fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
-{
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 4);
-}
-
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform4fv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform4fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
-
-static jsval FASTCALL
-nsICanvasRenderingContextWebGL_UniformMatrix2fv_tn(JSContext *cx, JSObject *obj, JSObject *loc, JSBool transpose, JSObject *arg)
-{
-    return helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 2);
-}
-
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_UniformMatrix2fv,
-    (5, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_UniformMatrix2fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACC_STORE_ANY)))
-
-static jsval FASTCALL
-nsICanvasRenderingContextWebGL_UniformMatrix3fv_tn(JSContext *cx, JSObject *obj, JSObject *loc, JSBool transpose, JSObject *arg)
-{
-    return helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 3);
-}
-
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_UniformMatrix3fv,
-    (5, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_UniformMatrix3fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACC_STORE_ANY)))
-
-static jsval FASTCALL
-nsICanvasRenderingContextWebGL_UniformMatrix4fv_tn(JSContext *cx, JSObject *obj, JSObject *loc, JSBool transpose, JSObject *arg)
-{
-    return helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 4);
-}
-
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_UniformMatrix4fv,
-    (5, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_UniformMatrix4fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACC_STORE_ANY)))
-
-#endif /* JS_TRACER */

dom/base/nsDOMClassInfo.cpp

@@ -9119,7 +9119,6 @@ nsHTMLDocumentSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
         // If we have (or just created) a helper, pass the resolve flags
         // to the helper as its private data.
         // TODO: fix
-        JS_ASSERT(false && "Relying on dirty private = int details");
         if (helper && !::JS_SetPrivate(cx, helper, FlagsToPrivate(flags))) {
           nsDOMClassInfo::ThrowJSException(cx, NS_ERROR_UNEXPECTED);
 

js/src/jspubtd.h

@@ -162,10 +162,11 @@ typedef struct JSCompartment     JSCompartment;
  * TODO: explain boxing strategy
  */
 
+#if defined(__cplusplus) || !defined(_MSC_VER)
 typedef enum JSValueMask16 
-#if defined(_MSC_VER)
+# if defined(_MSC_VER)
                            : uint16
-#endif
+# endif
 {
     JSVAL_MASK16_NULL      = (uint16)0x0001,
     JSVAL_MASK16_UNDEFINED = (uint16)0x0002,
@@ -188,10 +189,30 @@ typedef enum JSValueMask16
      */
     JSVAL_NANBOX_PATTERN   = ((uint16)0xFFFF)
 }
-#if defined(__GNUC__)
+# if defined(__GNUC__)
 __attribute__((packed))
-#endif
+# endif
 JSValueMask16;
+#else  /* defined(__cplusplus) || !defined(_MSC_VER) */
+// We need this C API for MSVC, because MSVC doesn't allow us to
+// make a 16-bit enum in C.
+typedef uint16 JSValueMask16;
+
+#define JSVAL_MASK16_NULL      ((uint16)0x0001)
+#define JSVAL_MASK16_UNDEFINED ((uint16)0x0002)
+#define JSVAL_MASK16_INT32     ((uint16)0x0004)
+#define JSVAL_MASK16_STRING    ((uint16)0x0008)
+#define JSVAL_MASK16_NONFUNOBJ ((uint16)0x0010)
+#define JSVAL_MASK16_FUNOBJ    ((uint16)0x0020)
+#define JSVAL_MASK16_BOOLEAN   ((uint16)0x0040)
+#define JSVAL_MASK16_MAGIC     ((uint16)0x0080)
+#define JSVAL_MASK16_SINGLETON (JSVAL_MASK16_NULL | JSVAL_MASK16_UNDEFINED)
+#define JSVAL_MASK16_OBJECT    (JSVAL_MASK16_NONFUNOBJ | JSVAL_MASK16_FUNOBJ)
+#define JSVAL_MASK16_OBJORNULL (JSVAL_MASK16_OBJECT | JSVAL_MASK16_NULL)
+#define JSVAL_MASK16_GCTHING   (JSVAL_MASK16_OBJECT | JSVAL_MASK16_STRING)
+#define JSVAL_NANBOX_PATTERN   ((uint16)0xFFFF)
+
+#endif /* defined(__cplusplus) || !defined(_MSC_VER) */
 
 #define JSVAL_MASK32_CLEAR      ((uint32)0xFFFF0000)
 
@@ -1130,15 +1151,15 @@ static inline JSEqualityOp     Jsvalify(EqualityOp f);      /* Same type as HasI
 }  /* namespace js */
 
 typedef js::Class JSFunctionClassType;
+extern "C" JS_FRIEND_DATA(JSFunctionClassType) js_FunctionClass;
 
 #else  /* !defined(__cplusplus) */
 
 typedef JSClass JSFunctionClassType;
+extern JS_FRIEND_DATA(JSFunctionClassType) js_FunctionClass;
 
 #endif /* __cplusplus */
 
-extern JS_FRIEND_DATA(JSFunctionClassType) js_FunctionClass;
-
 typedef struct JSPretendObject
 {
     void                *_;

js/src/jsrecursion.cpp

@@ -731,17 +731,8 @@ TraceRecorder::slurpInt32Slot(LIns* addr_ins, ptrdiff_t offset, Value* vp, VMSid
 {
     LIns *mask_ins = lir->insLoad(LIR_ldi, addr_ins, offset + offsetof(jsval_layout, s.u.mask32), 
                                   ACC_OTHER);
-    guard(false,
+    guard(true, lir->ins2(LIR_eqi, mask_ins, INS_CONST(JSVAL_MASK32_INT32)), exit);
-          lir->insEqI_0(lir->ins2(LIR_ori,
+    return lir->insLoad(LIR_ldi, addr_ins, offset + offsetof(jsval_layout, s.payload), ACC_OTHER);
-                                  lir->ins2(LIR_eqi, mask_ins, INS_CONST(JSVAL_MASK32_INT32)),
-                                  lir->ins2(LIR_ltui, mask_ins, INS_CONST(JSVAL_MASK32_CLEAR)))),
-          exit);
-    LIns* space = lir->insAlloc(sizeof(int32));
-    LIns* args[] = { space, lir->ins2(LIR_addp, addr_ins, INS_CONST(offset)) };
-    LIns* result = lir->insCall(&js_TryUnboxInt32_ci, args);
-    guard(false, lir->insEqI_0(result), exit);
-    LIns* int32_ins = lir->insLoad(LIR_ldi, space, 0, ACC_OTHER);
-    return int32_ins;
 }
 
 JS_REQUIRES_STACK LIns*
@@ -749,15 +740,8 @@ TraceRecorder::slurpDoubleSlot(LIns* addr_ins, ptrdiff_t offset, Value* vp, VMSi
 {
     LIns *mask_ins = lir->insLoad(LIR_ldi, addr_ins, offset + offsetof(jsval_layout, s.u.mask32), 
                                   ACC_OTHER);
-    guard(false,
+    guard(true, lir->ins2(LIR_ltui, mask_ins, INS_CONST(JSVAL_MASK32_CLEAR)), exit);
-          lir->insEqI_0(lir->ins2(LIR_ori,
+    return lir->insLoad(LIR_ldd, addr_ins, offset + offsetof(jsval_layout, s.payload), ACC_OTHER);
-                                  lir->ins2(LIR_eqi, mask_ins, INS_CONST(JSVAL_MASK32_INT32)),
-                                  lir->ins2(LIR_ltui, mask_ins, INS_CONST(JSVAL_MASK32_CLEAR)))),
-          exit);
-    LIns *val_ins = lir->insLoad(LIR_ldi, addr_ins, offset + offsetof(jsval_layout, s.payload),
-                                     ACC_OTHER);
-    LIns* args[] = { val_ins, mask_ins };
-    return lir->insCall(&js_UnboxDouble_ci, args);
 }
 
 JS_REQUIRES_STACK LIns*

js/src/jstracer.cpp

@@ -9372,12 +9372,13 @@ TraceRecorder::stobj_get_slot(LIns* obj_ins, unsigned slot, LIns*& dslots_ins)
 }
 
 JS_REQUIRES_STACK LIns*
-TraceRecorder::unbox_value(const Value &v, LIns *vaddr_ins, ptrdiff_t offset, VMSideExit *exit)
+TraceRecorder::unbox_value(const Value &v, LIns *vaddr_ins, ptrdiff_t offset, VMSideExit *exit,
+                           bool force_double)
 {
     AccSet accSet = vaddr_ins == lirbuf->sp ? ACC_STACK : ACC_OTHER;
     LIns *mask_ins = lir->insLoad(LIR_ldi, vaddr_ins, offset + offsetof(jsval_layout, s.u.mask32), 
                                   accSet);
-    if (v.isNumber()) {
+    if (v.isNumber() && force_double) {
         guard(false,
               lir->insEqI_0(lir->ins2(LIR_ori,
                                       lir->ins2(LIR_eqi, mask_ins, INS_CONST(JSVAL_MASK32_INT32)),
@@ -9389,8 +9390,17 @@ TraceRecorder::unbox_value(const Value &v, LIns *vaddr_ins, ptrdiff_t offset, VM
         return lir->insCall(&js_UnboxDouble_ci, args);
     }
 
-    LIns *val_ins = lir->insLoad(LIR_ldi, vaddr_ins, offset + offsetof(jsval_layout, s.payload),
+    if (v.isInt32()) {
-                                 accSet);
+        guard(true, lir->ins2(LIR_eqi, mask_ins, INS_CONST(JSVAL_MASK32_INT32)), exit);
+        return i2d(lir->insLoad(LIR_ldi, vaddr_ins, offset + offsetof(jsval_layout, s.payload), accSet));
+    }
+
+    if (v.isDouble()) {
+        guard(true, lir->ins2(LIR_ltui, mask_ins, INS_CONST(JSVAL_MASK32_CLEAR)), exit);
+        return lir->insLoad(LIR_ldd, vaddr_ins, offset + offsetof(jsval_layout, s.payload), accSet);
+    }
+
+    LIns *val_ins = NULL;
     uint32 mask;
     if (v.isUndefined()) {
         mask = JSVAL_MASK32_UNDEFINED;
@@ -9411,6 +9421,9 @@ TraceRecorder::unbox_value(const Value &v, LIns *vaddr_ins, ptrdiff_t offset, VM
     } else {
         JS_NOT_REACHED("bad type");
     }
+    if (!val_ins)
+        val_ins = lir->insLoad(LIR_ldi, vaddr_ins, offset + offsetof(jsval_layout, s.payload), 
+                               accSet);
     
     guard(true, lir->ins2(LIR_eqi, mask_ins, INS_CONST(mask)), exit);
     return val_ins;
@@ -13261,7 +13274,7 @@ TraceRecorder::denseArrayElement(Value& oval, Value& ival, Value*& vp, LIns*& v_
 	JS_ASSERT(sizeof(Value) == 8); // The |3| in the following statement requires this.
     addr_ins = lir->ins2(LIR_addp, dslots_ins,
                          lir->ins2ImmI(LIR_lshp, pidx_ins, 3));
-    v_ins = unbox_value(*vp, addr_ins, 0, exit);
+    v_ins = unbox_value(*vp, addr_ins, 0, exit, true);
 
     /* Don't let the hole value escape. Turn it into an undefined. */
     if (vp->isMagic()) {

js/src/jstracer.h

@@ -1329,7 +1329,8 @@ class TraceRecorder
                                                        int v_spindex);
 
     JS_REQUIRES_STACK nanojit::LIns* unbox_value(const Value &v, nanojit::LIns *vaddr_ins, 
-                                                 ptrdiff_t offset, VMSideExit *exit);
+                                                 ptrdiff_t offset, VMSideExit *exit,
+                                                 bool force_double=false);
     JS_REQUIRES_STACK nanojit::LIns* unbox_value_load(const Value &v, nanojit::LIns *vload_ins,
                                                       VMSideExit *exit);
     JS_REQUIRES_STACK nanojit::LIns* unbox_int(const Value &v, nanojit::LIns *vaddr_ins, 

js/src/trace-test/tests/basic/bug569651.js

@@ -0,0 +1,3 @@
+// don't crash or assert
+
++Function("switch(\"\"){case 1:case 8:}");

js/src/trace-test/tests/basic/bug572229.js

@@ -0,0 +1,12 @@
+// Don't crash
+
+function f(o, s) {
+    var k = s.substr(0, 1);
+    var c;
+    for (var i = 0; i < 10; ++i) {
+	c = k in o;
+    }
+    return c;
+}
+
+assertEq(f({ a: 66 }, 'abc'), true);

js/src/xpconnect/src/Makefile.in

@@ -159,7 +159,10 @@ DEFINES += \
   $(addprefix -D,$(filter AVMPLUS%,$(CONFIG))) \
   $(NULL)
 
-ENABLE_TRACEABLE_FLAGS = --enable-traceables
+# Disable traceable natives because (a) many of them return jsvals, which is
+# hard to support now, and (b) we can call the basic versions from trace now
+# anyway.
+ENABLE_TRACEABLE_FLAGS =
 
 endif # ENABLE_JIT
 

js/src/xpconnect/src/XPCDispConvert.cpp

@@ -309,7 +309,7 @@ JSBool XPCDispConvert::JSToCOM(XPCCallContext& ccx,
         case VT_R8:
         {
             varDest->vt = VT_R8;
-            varDest->dblVal = *JSVAL_TO_DOUBLE(src);
+            varDest->dblVal = JSVAL_TO_DOUBLE(src);
         }
         break;
         case VT_EMPTY:

js/src/xpconnect/src/XPCDispInterface.cpp

@@ -366,7 +366,7 @@ JSBool XPCDispInterface::Member::GetValue(XPCCallContext& ccx,
             return JS_FALSE;
 
         // Store ourselves and our native interface within the JSObject
-        if(!JS_SetReservedSlot(ccx, funobj, 0, PRIVATE_TO_JSVAL(this)))
+        if(!JS_SetReservedSlot(ccx, funobj, 0, PRIVATE_TO_JSVAL((void *) this)))
             return JS_FALSE;
 
         if(!JS_SetReservedSlot(ccx, funobj, 1, PRIVATE_TO_JSVAL(iface)))