Added support for semi-stable loop variables. Compiling for(...) q += 2.5; is ridiculously difficult because it flip-flops between int and double. Add support to promote integer values to doubles at the loop tail if at loop entry we expect a double. Since this isn't possible the other way around, we have to get luck that we catch a path into the loop where q is already double. For this we add 3 trigger points (10, 13, 37). We will try three times to record a trace at those iteration counts of a loop. If none succeed the loop is blacklisted. This probably needs more tuning down the road.

js/src/jsbuiltins.cpp

@@ -97,12 +97,7 @@ FASTCALL jsint builtin_UnboxInt32(JSContext* cx, jsval v)
     return INT32_ERROR_COOKIE;
 }
 
-FASTCALL int32 builtin_DoubleToECMAInt32(jsdouble d)
+FASTCALL int32 builtin_doubleToInt32(jsdouble d)
 {
     return js_DoubleToECMAInt32(d);
 }
-
-FASTCALL uint32 builtin_DoubleToECMAUint32(jsdouble d)
-{
-    return js_DoubleToECMAUint32(d);
-}