[JAEGER] Unbroke build, merge merge merge.

js/src/jsapi.cpp

@@ -1751,8 +1751,7 @@ JS_GetGlobalForScopeChain(JSContext *cx)
 JS_PUBLIC_API(jsval)
 JS_ComputeThis(JSContext *cx, jsval *vp)
 {
-    assertSameCompartment(cx, JSValueArray(vp, 2));
+    if (!ComputeThisFromVpInPlace(cx, Valueify(vp)))
-    if (!ComputeThisFromVp(cx, Valueify(vp)))
         return JSVAL_NULL;
     return vp[1];
 }

js/src/jsemit.cpp

@@ -1337,7 +1337,7 @@ js_PushBlockScope(JSTreeContext *tc, JSStmtInfo *stmt, JSObject *blockObj,
 {
     js_PushStatement(tc, stmt, STMT_BLOCK, top);
     stmt->flags |= SIF_SCOPE;
-    blockObj->setParent(ObjectOrNullTag(tc->blockChain));
+    blockObj->setParent(tc->blockChain);
     stmt->downScope = tc->topScopeStmt;
     tc->topScopeStmt = stmt;
     tc->blockChain = blockObj;
@@ -1558,7 +1558,7 @@ js_DefineCompileTimeConstant(JSContext *cx, JSCodeGenerator *cg, JSAtom *atom,
 {
     /* XXX just do numbers for now */
     if (pn->pn_type == TOK_NUMBER) {
-        if (!cg->constMap.put(atom, NumberTag(pn->pn_dval)))
+        if (!cg->constMap.put(atom, NumberValue(pn->pn_dval)))
             return JS_FALSE;
     }
     return JS_TRUE;
@@ -1590,7 +1590,7 @@ js_LexicalLookup(JSTreeContext *tc, JSAtom *atom, jsint *slotp, JSStmtInfo *stmt
 
             if (slotp) {
                 JS_ASSERT(obj->fslots[JSSLOT_BLOCK_DEPTH].isInt32());
-                *slotp = obj->fslots[JSSLOT_BLOCK_DEPTH].asInt32() +
+                *slotp = obj->fslots[JSSLOT_BLOCK_DEPTH].toInt32() +
                          sprop->shortid;
             }
             return stmt;
@@ -1845,7 +1845,7 @@ EmitEnterBlock(JSContext *cx, JSParseNode *pn, JSCodeGenerator *cg)
             continue;
         }
 
-        JSDefinition *dn = (JSDefinition *) v.asPrivate();
+        JSDefinition *dn = (JSDefinition *) v.toPrivate();
         JS_ASSERT(dn->pn_defn);
         JS_ASSERT(uintN(dn->frameSlot() + depth) < JS_BIT(16));
         dn->pn_cookie.set(dn->pn_cookie.level(), dn->frameSlot() + depth);
@@ -2149,13 +2149,13 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 
         JSCodeGenerator *globalCg = cg->compiler()->globalScope->cg;
         if (globalCg != cg) {
-            uint32 slot = globalCg->globalUses[cookie].slot;
+            uint32 slot = globalCg->globalUses[cookie.asInteger()].slot;
 
             /* Fall back to NAME if we can't add a slot. */
-            if (!cg->addGlobalUse(atom, slot, &cookie))
+            if (!cg->addGlobalUse(atom, slot, cookie))
                 return JS_FALSE;
 
-            if (cookie == FREE_UPVAR_COOKIE)
+            if (cookie.isFree())
                 return JS_TRUE;
         }
         pn->pn_op = op;
@@ -2392,17 +2392,17 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 }
 
 bool
-JSCodeGenerator::addGlobalUse(JSAtom *atom, uint32 slot, uint32 *indexp)
+JSCodeGenerator::addGlobalUse(JSAtom *atom, uint32 slot, UpvarCookie &cookie)
 {
     JSAtomListElement *ale = globalMap.lookup(atom);
     if (ale) {
-        *indexp = ALE_INDEX(ale);
+        cookie.set(0, ALE_INDEX(ale));
         return true;
     }
 
     /* Don't bother encoding indexes >= uint16 */
     if (globalUses.length() >= UINT16_LIMIT) {
-        *indexp = FREE_UPVAR_COOKIE;
+        cookie.makeFree();
         return true;
     }
 
@@ -2411,7 +2411,7 @@ JSCodeGenerator::addGlobalUse(JSAtom *atom, uint32 slot, uint32 *indexp)
     if (!ale)
         return false;
 
-    *indexp = uint32(globalUses.length());
+    cookie.set(0, globalUses.length());
 
     GlobalSlotArray::Entry entry = { ALE_INDEX(ale), slot };
     if (!globalUses.append(entry))
@@ -2421,7 +2421,7 @@ JSCodeGenerator::addGlobalUse(JSAtom *atom, uint32 slot, uint32 *indexp)
     if (!ale)
         return false;
 
-    ALE_SET_INDEX(ale, *indexp);
+    ALE_SET_INDEX(ale, cookie.asInteger());
     return true;
 }
 
@@ -3013,7 +3013,7 @@ EmitNumberOp(JSContext *cx, jsdouble dval, JSCodeGenerator *cg)
         return JS_TRUE;
     }
 
-    if (!cg->constList.append(DoubleTag(dval)))
+    if (!cg->constList.append(DoubleValue(dval)))
         return JS_FALSE;
 
     return EmitIndexOp(cx, JSOP_DOUBLE, cg->constList.length() - 1, cg);
@@ -3221,7 +3221,7 @@ EmitSwitch(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
                 switchOp = JSOP_LOOKUPSWITCH;
                 continue;
             }
-            i = pn3->pn_pval->asInt32();
+            i = pn3->pn_pval->toInt32();
             if ((jsuint)(i + (jsint)JS_BIT(15)) >= (jsuint)JS_BIT(16)) {
                 switchOp = JSOP_LOOKUPSWITCH;
                 continue;
@@ -3416,7 +3416,7 @@ EmitSwitch(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
                 for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
                     if (pn3->pn_type == TOK_DEFAULT)
                         continue;
-                    i = pn3->pn_pval->asInt32();
+                    i = pn3->pn_pval->toInt32();
                     i -= low;
                     JS_ASSERT((uint32)i < tableLength);
                     table[i] = pn3;
@@ -3690,7 +3690,7 @@ MaybeEmitVarDecl(JSContext *cx, JSCodeGenerator *cg, JSOp prologOp,
         (((JSDefinition *)pn)->pn_dflags & PND_CLOSED))
     {
         CG_SWITCH_TO_PROLOG(cg);
-        EMIT_UINT16_IMM_OP(JSOP_DEFUPVAR, pn->pn_cookie);
+        EMIT_UINT16_IMM_OP(JSOP_DEFUPVAR, pn->pn_cookie.asInteger());
         CG_SWITCH_TO_MAIN(cg);
     }
 
@@ -3754,8 +3754,6 @@ EmitDestructuringOpsHelper(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn);
 static JSBool
 EmitDestructuringLHS(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 {
-    jsuint slot;
-
     /*
      * Now emit the lvalue opcode sequence.  If the lvalue is a nested
      * destructuring initialiser-form, call ourselves to handle it, then
@@ -3797,14 +3795,17 @@ EmitDestructuringLHS(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             jsuint slot = pn->pn_cookie.asInteger();
             EMIT_UINT16_IMM_OP(JSOP_SETLOCALPOP, slot);
             break;
+          }
 
           case JSOP_SETARG:
           case JSOP_SETGLOBAL:
+          {
             jsuint slot = pn->pn_cookie.asInteger();
             EMIT_UINT16_IMM_OP(PN_OP(pn), slot);
             if (js_Emit1(cx, cg, JSOP_POP) < 0)
                 return JS_FALSE;
             break;
+          }
 
           default:
           {
@@ -4500,7 +4501,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          */
         if (!cg->inFunction()) {
             JS_ASSERT(!cg->topStmt);
-            if (pn->pn_cookie == FREE_UPVAR_COOKIE) {
+            if (pn->pn_cookie.isFree()) {
                 CG_SWITCH_TO_PROLOG(cg);
                 op = FUN_FLAT_CLOSURE(fun) ? JSOP_DEFFUN_FC : JSOP_DEFFUN;
                 EMIT_INDEX_OP(op, index);

js/src/jsemit.h

@@ -530,7 +530,7 @@ struct JSCodeGenerator : public JSTreeContext
      */
     ~JSCodeGenerator();
 
-    bool addGlobalUse(JSAtom *atom, uint32 slot, uint32 *indexp);
+    bool addGlobalUse(JSAtom *atom, uint32 slot, js::UpvarCookie &cooke);
 
     bool hasSharps() {
         bool rv = !!(flags & TCF_HAS_SHARPS);

js/src/jsgc.cpp

@@ -3515,7 +3515,7 @@ SetProtoCheckingForCycles(JSContext *cx, JSObject *obj, JSObject *proto)
                 cycle = true;
                 break;
             }
-            obj2 = (slot == JSSLOT_PARENT) ? obj2->getParent() : obj2->getProto();
+            obj2 = obj2->getProto();
         }
         if (!cycle)
             obj->setProto(proto);

js/src/jsinterp.cpp

@@ -268,10 +268,10 @@ CallThisObjectHook(JSContext *cx, JSObject *obj, Value *argv)
  *
  * The alert should display "true".
  */
-JS_STATIC_INTERPRET JSObject *
+JS_STATIC_INTERPRET bool
 ComputeGlobalThis(JSContext *cx, Value *argv)
 {
-    JSObject *thisp = argv[-2].asObject().getGlobal()->thisObject(cx);
+    JSObject *thisp = argv[-2].toObject().getGlobal()->thisObject(cx);
     if (!thisp)
         return false;
     argv[-1].setObject(*thisp);
@@ -287,13 +287,13 @@ JSStackFrame::computeThisObject(JSContext *cx)
     if (!ComputeThisFromArgv(cx, argv))
         return NULL;
     thisv = argv[-1];
-    JS_ASSERT(IsSaneThisObject(thisv.asObject()));
+    JS_ASSERT(IsSaneThisObject(thisv.toObject()));
-    return &thisv.asObject();
+    return &thisv.toObject();
 }
 
 namespace js {
 
-JSObject *
+bool
 ComputeThisFromArgv(JSContext *cx, Value *argv)
 {
     JS_ASSERT(!argv[-1].isMagic());  // check for SynthesizeFrame poisoning
@@ -303,7 +303,7 @@ ComputeThisFromArgv(JSContext *cx, Value *argv)
     if (!argv[-1].isObject())
         return !!js_PrimitiveToObject(cx, &argv[-1]);
 
-    JS_ASSERT(IsSaneThisObject(argv[-1].asObject()));
+    JS_ASSERT(IsSaneThisObject(argv[-1].toObject()));
     return true;
 }
 
@@ -336,7 +336,7 @@ Class js_NoSuchMethodClass = {
  * call by name, and args is an Array containing this invocation's actual
  * parameters.
  */
-JSBool
+JS_STATIC_INTERPRET JSBool
 js_OnUnknownMethod(JSContext *cx, Value *vp)
 {
     JS_ASSERT(!vp[1].isPrimitive());
@@ -469,14 +469,8 @@ RunScript(JSContext *cx, JSScript *script, JSFunction *fun, JSObject *scopeChain
     return Interpret(cx);
 }
 
-/*
+static JS_REQUIRES_STACK bool
- * Find a function reference and its 'this' object implicit first parameter
+callJSNative(JSContext *cx, CallOp callOp, JSObject *thisp, uintN argc, Value *argv, Value *rval)
- * under argc arguments on cx's stack, and call the function.  Push missing
- * required arguments, allocate declared local variables, and pop everything
- * when done.  Then push the return value.
- */
-JS_REQUIRES_STACK bool
-Invoke(JSContext *cx, const InvokeArgsGuard &args, uintN flags)
 {
     Value *vp = argv - 2;
     if (callJSFastNative(cx, callOp, argc, vp)) {
@@ -494,37 +488,6 @@ InvokeCommon(JSContext *cx, JSFunction *fun, JSScript *script, T native,
     uintN argc = args.getArgc();
     Value *vp = args.getvp();
 
-        if (JSFUN_BOUND_METHOD_TEST(fun->flags)) {
-            /* Handle bound method special case. */
-            vp[1].setObjectOrNull(parent);
-        } else if (vp[1].isPrimitive()) {
-            JS_ASSERT(!(flags & JSINVOKE_CONSTRUCT));
-            if (PrimitiveThisTest(fun, vp[1]))
-                goto start_call;
-        }
-    }
-
-    if (flags & JSINVOKE_CONSTRUCT) {
-        JS_ASSERT(vp[1].isObject());
-    } else {
-        /*
-         * We must call js_ComputeThis in case we are not called from the
-         * interpreter, where a prior bytecode has computed an appropriate
-         * |this| already.
-         *
-         * But we need to compute |this| eagerly only for so-called "slow"
-         * (i.e., not fast) native functions. Fast natives must use either
-         * JS_THIS or JS_THIS_OBJECT, and scripted functions will go through
-         * the appropriate this-computing bytecode, e.g., JSOP_THIS.
-         */
-        if (native && (!fun || !(fun->flags & JSFUN_FAST_NATIVE))) {
-            if (!ComputeThisFromArgv(cx, vp + 2))
-                return false;
-            flags |= JSFRAME_COMPUTED_THIS;
-        }
-    }
-
-  start_call:
     if (native && fun && fun->isFastNative()) {
 #ifdef DEBUG_NOT_THROWING
         JSBool alreadyThrowing = cx->throwing;
@@ -631,16 +594,18 @@ InvokeCommon(JSContext *cx, JSFunction *fun, JSScript *script, T native,
          * interpreter, where a prior bytecode has computed an appropriate
          * |this| already.
          */
-        JSObject *thisp = vp[1].asObjectOrNull();
+        JSObject *thisp = vp[1].toObjectOrNull();
-        if (!thisp)
+        if (!thisp) {
+            JSObject *funobj = &args.getvp()[0].toObject();
             thisp = funobj->getGlobal();
+        }
         thisp = thisp->thisObject(cx);
         if (!thisp)
              return false;
          vp[1].setObject(*thisp);
          fp->thisv.setObject(*thisp);
     }
-    JS_ASSERT_IF(!vp[1].isPrimitive(), IsSaneThisObject(vp[1].asObject()));
+    JS_ASSERT_IF(!vp[1].isPrimitive(), IsSaneThisObject(vp[1].toObject()));
 
     /* Call the hook if present after we fully initialized the frame. */
     JSInterpreterHook hook = cx->debugHooks->callHook;
@@ -657,8 +622,9 @@ InvokeCommon(JSContext *cx, JSFunction *fun, JSScript *script, T native,
         JSBool alreadyThrowing = cx->throwing;
 #endif
         /* Primitive |this| should not be passed to slow natives. */
-        JSObject *thisp = fun ? fp->getThisObject(cx) : fp->thisv.asObjectOrNull();
+        JSObject *thisp = fun ? fp->getThisObject(cx) : fp->thisv.toObjectOrNull();
-        ok = native(cx, thisp, fp->argc, fp->argv, &fp->rval);
+        ok = callJSNative(cx, native, thisp, fp->argc, fp->argv, &fp->rval);
+
         JS_ASSERT(cx->fp == fp);
         JS_RUNTIME_METER(cx->runtime, nativeCalls);
 #ifdef DEBUG_NOT_THROWING
@@ -668,7 +634,7 @@ InvokeCommon(JSContext *cx, JSFunction *fun, JSScript *script, T native,
     } else {
         JS_ASSERT(script);
         AutoPreserveEnumerators preserve(cx);
-        ok = RunScript(cx, script, fun, &fp->scopeChain.asObject());
+        ok = RunScript(cx, script, fun, fp->scopeChain);
     }
 
     DTrace::exitJSFun(cx, fp, fun, fp->rval);
@@ -756,7 +722,6 @@ Invoke(JSContext *cx, const InvokeArgsGuard &args, uintN flags)
                 Value *vp = args.getvp();
                 if (!ComputeThisFromVp(cx, vp))
                     return false;
-                flags |= JSFRAME_COMPUTED_THIS;
             }
         }
         return InvokeCommon(cx, fun, script, native, args, flags);
@@ -963,7 +928,7 @@ Execute(JSContext *cx, JSObject *chain, JSScript *script,
         hookData = hook(cx, fp, JS_TRUE, 0, cx->debugHooks->executeHookData);
 
     AutoPreserveEnumerators preserve(cx);
-    JSBool ok = RunScript(cx, script, NULL, &fp->scopeChain.asObject());
+    JSBool ok = RunScript(cx, script, NULL, fp->scopeChain);
     if (result)
         *result = fp->rval;
 
@@ -2300,7 +2265,7 @@ Interpret(JSContext *cx)
     (fun = script->getFunction(GET_FULL_INDEX(PCOFF)))
 
 #define LOAD_DOUBLE(PCOFF, dbl)                                               \
-    (dbl = script->getConst(GET_FULL_INDEX(PCOFF)).asDouble())
+    (dbl = script->getConst(GET_FULL_INDEX(PCOFF)).toDouble())
 
 #ifdef JS_TRACER
 

js/src/jsinterp.h

@@ -222,10 +222,10 @@ struct JSStackFrame
         return !!(flags & JSFRAME_FLOATING_GENERATOR);
     }
 
+    bool isDummyFrame() const { return !script && !fun; }
+
   private:
     JSObject *computeThisObject(JSContext *cx);
-
-    bool isDummyFrame() const { return !script && !fun; }
 };
 
 namespace js {
@@ -276,12 +276,20 @@ namespace js {
  * primitive values with the equivalent wrapper objects. argv[-1] must
  * not be JSVAL_VOID or an activation object.
  */
-extern JSObject *
+extern bool
 ComputeThisFromArgv(JSContext *cx, js::Value *argv);
 
 JS_ALWAYS_INLINE JSObject *
 ComputeThisFromVp(JSContext *cx, js::Value *vp)
 {
+    extern bool ComputeThisFromArgv(JSContext *, js::Value *);
+    return ComputeThisFromArgv(cx, vp + 2) ? &vp[1].toObject() : NULL;
+}
+
+JS_ALWAYS_INLINE bool
+ComputeThisFromVpInPlace(JSContext *cx, js::Value *vp)
+{
+    extern bool ComputeThisFromArgv(JSContext *, js::Value *);
     return ComputeThisFromArgv(cx, vp + 2);
 }
 
@@ -487,13 +495,7 @@ js_OnUnknownMethod(JSContext *cx, js::Value *vp);
 inline JSObject *
 JSStackFrame::getThisObject(JSContext *cx)
 {
-    if (flags & JSFRAME_COMPUTED_THIS)
+    return thisv.isPrimitive() ? computeThisObject(cx) : &thisv.toObject();
-        return &thisv.toObject();
-    if (!js::ComputeThisFromArgv(cx, argv))
-        return NULL;
-    thisv = argv[-1];
-    flags |= JSFRAME_COMPUTED_THIS;
-    return &thisv.toObject();
 }
 
 #endif /* jsinterp_h___ */

js/src/jsiter.cpp

@@ -1253,7 +1253,7 @@ SendToGenerator(JSContext *cx, JSGeneratorOp op, JSObject *obj,
         JSObject *enumerators = cx->enumerators;
         cx->enumerators = gen->enumerators;
 
-        ok = RunScript(cx, fp->script, fp->fun, &fp->scopeChain.asObject());
+        ok = RunScript(cx, fp->script, fp->fun, fp->scopeChain);
 
         /* Restore the original enumerators stack. */
         gen->enumerators = cx->enumerators;

js/src/jsops.cpp

@@ -743,7 +743,7 @@ END_CASE(JSOP_ENUMCONSTELEM)
 #endif
 
 BEGIN_CASE(JSOP_BINDGNAME)
-    PUSH_OBJECT(*fp->scopeChainObj()->getGlobal());
+    PUSH_OBJECT(*fp->scopeChain->getGlobal());
 END_CASE(JSOP_BINDGNAME)
 
 BEGIN_CASE(JSOP_BINDNAME)
@@ -1482,7 +1482,7 @@ BEGIN_CASE(JSOP_GLOBALDEC)
     slot = GET_SLOTNO(regs.pc);
     slot = script->getGlobalSlot(slot);
     JSObject *obj;
-    obj = fp->scopeChainObj()->getGlobal();
+    obj = fp->scopeChain->getGlobal();
     vp = &obj->getSlotRef(slot);
     goto do_int_fast_incop;
 END_CASE(JSOP_INCGLOBAL)
@@ -1795,7 +1795,7 @@ BEGIN_CASE(JSOP_SETMETHOD)
     JSObject *obj;
     VALUE_TO_OBJECT(cx, &lref, obj);
 
-    JS_ASSERT_IF(op == JSOP_SETGNAME, obj == fp->scopeChainObj()->getGlobal());
+    JS_ASSERT_IF(op == JSOP_SETGNAME, obj == fp->scopeChain->getGlobal());
 
     do {
         PropertyCache *cache = &JS_PROPERTY_CACHE(cx);
@@ -2259,7 +2259,7 @@ BEGIN_CASE(JSOP_APPLY)
                 *disp = newfp;
             }
             JS_ASSERT(!JSFUN_BOUND_METHOD_TEST(fun->flags));
-            JS_ASSERT_IF(!vp[1].isPrimitive(), IsSaneThisObject(vp[1].asObject()));
+            JS_ASSERT_IF(!vp[1].isPrimitive(), IsSaneThisObject(vp[1].toObject()));
             newfp->thisv = vp[1];
             newfp->imacpc = NULL;
 
@@ -2331,7 +2331,7 @@ BEGIN_CASE(JSOP_APPLY)
              * complete.
              */
             if (!TRACE_RECORDER(cx)) {
-                JSObject *scope = newfp->scopeChainObj();
+                JSObject *scope = newfp->scopeChain;
                 mjit::CompileStatus status = mjit::CanMethodJIT(cx, newscript, fun, scope);
                 if (status == mjit::Compile_Error)
                     goto error;
@@ -2932,7 +2932,7 @@ BEGIN_CASE(JSOP_CALLGLOBAL)
 {
     uint32 slot = GET_SLOTNO(regs.pc);
     slot = script->getGlobalSlot(slot);
-    JSObject *obj = fp->scopeChainObj()->getGlobal();
+    JSObject *obj = fp->scopeChain->getGlobal();
     JS_ASSERT(slot < obj->scope()->freeslot);
     PUSH_COPY(obj->getSlot(slot));
     if (op == JSOP_CALLGLOBAL)
@@ -2943,12 +2943,12 @@ END_CASE(JSOP_GETGLOBAL)
 BEGIN_CASE(JSOP_FORGLOBAL)
 {
     Value rval;
-    if (!IteratorNext(cx, &regs.sp[-1].asObject(), &rval))
+    if (!IteratorNext(cx, &regs.sp[-1].toObject(), &rval))
         goto error;
     PUSH_COPY(rval);
     uint32 slot = GET_SLOTNO(regs.pc);
     slot = script->getGlobalSlot(slot);
-    JSObject *obj = fp->scopeChainObj()->getGlobal();
+    JSObject *obj = fp->scopeChain->getGlobal();
     JS_ASSERT(slot < obj->scope()->freeslot);
     JS_LOCK_OBJ(cx, obj);
     {
@@ -2968,7 +2968,7 @@ BEGIN_CASE(JSOP_SETGLOBAL)
 {
     uint32 slot = GET_SLOTNO(regs.pc);
     slot = script->getGlobalSlot(slot);
-    JSObject *obj = fp->scopeChainObj()->getGlobal();
+    JSObject *obj = fp->scopeChain->getGlobal();
     JS_ASSERT(slot < obj->scope()->freeslot);
     {
         JS_LOCK_OBJ(cx, obj);

js/src/jsparse.cpp

@@ -3021,7 +3021,7 @@ Parser::functionDef(uintN lambda, bool namePermitted)
 
     if (!outertc->inFunction() && topLevel && funAtom && !lambda &&
         outertc->compiling()) {
-        JS_ASSERT(pn->pn_cookie == FREE_UPVAR_COOKIE);
+        JS_ASSERT(pn->pn_cookie.isFree());
         if (!DefineGlobal(pn, (JSCodeGenerator *)outertc, funAtom))
             return false;
     }
@@ -3343,20 +3343,20 @@ DefineGlobal(JSParseNode *pn, JSCodeGenerator *cg, JSAtom *atom)
          * we can. If we can't, don't bother emitting a GVAR op,
          * since it's unlikely that it will optimize either.
          */
-        uint32 index;
+        UpvarCookie cookie;
         if (!sprop->configurable() &&
             SPROP_HAS_VALID_SLOT(sprop, globalObj->scope()) &&
             sprop->hasDefaultGetterOrIsMethod() &&
             sprop->hasDefaultSetter() &&
             pn->pn_type != TOK_FUNCTION)
         {
-            if (!cg->addGlobalUse(atom, sprop->slot, &index)) {
+            if (!cg->addGlobalUse(atom, sprop->slot, cookie)) {
                 JS_UNLOCK_SCOPE(cg->parser->context, scope);
                 return false;
             }
-            if (index != FREE_UPVAR_COOKIE) {
+            if (!cookie.isFree()) {
                 pn->pn_op = JSOP_GETGLOBAL;
-                pn->pn_cookie = index;
+                pn->pn_cookie.set(cookie);
                 pn->pn_dflags |= PND_BOUND | PND_GVAR;
             }
         }
@@ -3391,12 +3391,12 @@ DefineGlobal(JSParseNode *pn, JSCodeGenerator *cg, JSAtom *atom)
             return false;
     }
 
-    uint32 index;
+    UpvarCookie cookie;
-    if (!cg->addGlobalUse(atom, slot, &index))
+    if (!cg->addGlobalUse(atom, slot, cookie))
         return false;
 
-    if (index != FREE_UPVAR_COOKIE) {
+    if (!cookie.isFree()) {
-        pn->pn_cookie = index;
+        pn->pn_cookie.set(cookie);
         pn->pn_dflags |= PND_GVAR;
         if (pn->pn_type != TOK_FUNCTION) {
             pn->pn_op = JSOP_GETGLOBAL;

js/src/jsscript.h

@@ -96,6 +96,7 @@ class UpvarCookie
     void set(const UpvarCookie &other) { set(other.level(), other.slot()); }
     void set(uint16 newLevel, uint16 newSlot) { value = (uint32(newLevel) << 16) | newSlot; }
     void makeFree() { set(0xffff, 0xffff); JS_ASSERT(isFree()); }
+    void fromInteger(uint32 u32) { value = u32; }
 };
 JS_STATIC_ASSERT(sizeof(UpvarCookie) == sizeof(uint32));
 

js/src/methodjit/Compiler.cpp

@@ -192,7 +192,7 @@ mjit::Compiler::generatePrologue()
         /* Set locals to undefined. */
         for (uint32 i = 0; i < script->nslots; i++) {
             Address local(JSFrameReg, sizeof(JSStackFrame) + i * sizeof(Value));
-            masm.storeValue(UndefinedTag(), local);
+            masm.storeValue(UndefinedValue(), local);
         }
 
         /* Create the call object. */
@@ -400,7 +400,7 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_NOP)
 
           BEGIN_CASE(JSOP_PUSH)
-            frame.push(UndefinedTag());
+            frame.push(UndefinedValue());
           END_CASE(JSOP_PUSH)
 
           BEGIN_CASE(JSOP_POPV)
@@ -553,7 +553,7 @@ mjit::Compiler::generateMethod()
                     frame.pop();
 
                     if (!target) {
-                        frame.push(Value(BooleanTag(result)));
+                        frame.push(Value(BooleanValue(result)));
                     } else {
                         if (fused == JSOP_IFEQ)
                             result = !result;
@@ -633,7 +633,7 @@ mjit::Compiler::generateMethod()
                 ValueToECMAInt32(cx, top->getValue(), &i);
                 i = ~i;
                 frame.pop();
-                frame.push(Int32Tag(i));
+                frame.push(Int32Value(i));
             } else {
                 jsop_bitnot();
             }
@@ -648,7 +648,7 @@ mjit::Compiler::generateMethod()
                 ValueToNumber(cx, top->getValue(), &d);
                 d = -d;
                 frame.pop();
-                frame.push(DoubleTag(d));
+                frame.push(DoubleValue(d));
             } else {
                 jsop_neg();
             }
@@ -666,7 +666,7 @@ mjit::Compiler::generateMethod()
 
           BEGIN_CASE(JSOP_VOID)
             frame.pop();
-            frame.push(UndefinedTag());
+            frame.push(UndefinedValue());
           END_CASE(JSOP_VOID)
 
           BEGIN_CASE(JSOP_INCNAME)
@@ -792,8 +792,8 @@ mjit::Compiler::generateMethod()
           BEGIN_CASE(JSOP_DOUBLE)
           {
             uint32 index = fullAtomIndex(PC);
-            double d = script->getConst(index).asDouble();
+            double d = script->getConst(index).toDouble();
-            frame.push(Value(DoubleTag(d)));
+            frame.push(Value(DoubleValue(d)));
           }
           END_CASE(JSOP_DOUBLE)
 
@@ -801,7 +801,7 @@ mjit::Compiler::generateMethod()
           {
             JSAtom *atom = script->getAtom(fullAtomIndex(PC));
             JSString *str = ATOM_TO_STRING(atom);
-            frame.push(Value(StringTag(str)));
+            frame.push(Value(StringValue(str)));
           }
           END_CASE(JSOP_STRING)
 
@@ -814,7 +814,7 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_ONE)
 
           BEGIN_CASE(JSOP_NULL)
-            frame.push(NullTag());
+            frame.push(NullValue());
           END_CASE(JSOP_NULL)
 
           BEGIN_CASE(JSOP_THIS)
@@ -822,11 +822,11 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_THIS)
 
           BEGIN_CASE(JSOP_FALSE)
-            frame.push(Value(BooleanTag(false)));
+            frame.push(Value(BooleanValue(false)));
           END_CASE(JSOP_FALSE)
 
           BEGIN_CASE(JSOP_TRUE)
-            frame.push(Value(BooleanTag(true)));
+            frame.push(Value(BooleanValue(true)));
           END_CASE(JSOP_TRUE)
 
           BEGIN_CASE(JSOP_OR)
@@ -920,7 +920,7 @@ mjit::Compiler::generateMethod()
           {
             jsop_getarg(GET_SLOTNO(PC));
             if (op == JSOP_CALLARG)
-                frame.push(NullTag());
+                frame.push(NullValue());
           }
           END_CASE(JSOP_GETARG)
 
@@ -958,7 +958,7 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_SETLOCAL)
 
           BEGIN_CASE(JSOP_UINT16)
-            frame.push(Value(Int32Tag((int32_t) GET_UINT16(PC))));
+            frame.push(Value(Int32Value((int32_t) GET_UINT16(PC))));
           END_CASE(JSOP_UINT16)
 
           BEGIN_CASE(JSOP_NEWINIT)
@@ -1139,7 +1139,7 @@ mjit::Compiler::generateMethod()
             frame.freeReg(reg);
             frame.push(Address(reg, GET_UINT16(PC) * sizeof(Value)));
             if (op == JSOP_CALLDSLOT)
-                frame.push(NullTag());
+                frame.push(NullValue());
           }
           END_CASE(JSOP_CALLDSLOT)
 
@@ -1178,7 +1178,7 @@ mjit::Compiler::generateMethod()
           BEGIN_CASE(JSOP_CALLGNAME)
             jsop_getgname(fullAtomIndex(PC));
             if (op == JSOP_CALLGNAME)
-                frame.push(NullTag());
+                frame.push(NullValue());
           END_CASE(JSOP_GETGNAME)
 
           BEGIN_CASE(JSOP_SETGNAME)
@@ -1209,16 +1209,16 @@ mjit::Compiler::generateMethod()
             JS_ASSERT(index < uva->length);
 
             prepareStubCall();
-            masm.move(Imm32(uva->vector[index]), Registers::ArgReg1);
+            masm.move(Imm32(uva->vector[index].asInteger()), Registers::ArgReg1);
             stubCall(stubs::GetUpvar, Uses(0), Defs(1));
             frame.pushSynced();
             if (op == JSOP_CALLUPVAR)
-                frame.push(NullTag());
+                frame.push(NullValue());
           }
           END_CASE(JSOP_CALLUPVAR)
 
           BEGIN_CASE(JSOP_UINT24)
-            frame.push(Value(Int32Tag((int32_t) GET_UINT24(PC))));
+            frame.push(Value(Int32Value((int32_t) GET_UINT24(PC))));
           END_CASE(JSOP_UINT24)
 
           BEGIN_CASE(JSOP_CALLELEM)
@@ -1265,15 +1265,15 @@ mjit::Compiler::generateMethod()
 
           BEGIN_CASE(JSOP_CALLLOCAL)
             frame.pushLocal(GET_SLOTNO(PC));
-            frame.push(NullTag());
+            frame.push(NullValue());
           END_CASE(JSOP_CALLLOCAL)
 
           BEGIN_CASE(JSOP_INT8)
-            frame.push(Value(Int32Tag(GET_INT8(PC))));
+            frame.push(Value(Int32Value(GET_INT8(PC))));
           END_CASE(JSOP_INT8)
 
           BEGIN_CASE(JSOP_INT32)
-            frame.push(Value(Int32Tag(GET_INT32(PC))));
+            frame.push(Value(Int32Value(GET_INT32(PC))));
           END_CASE(JSOP_INT32)
 
           BEGIN_CASE(JSOP_NEWARRAY)
@@ -1355,7 +1355,7 @@ mjit::Compiler::generateMethod()
           BEGIN_CASE(JSOP_CALLGLOBAL)
             jsop_getglobal(GET_SLOTNO(PC));
             if (op == JSOP_CALLGLOBAL)
-                frame.push(NullTag());
+                frame.push(NullValue());
           END_CASE(JSOP_GETGLOBAL)
 
           BEGIN_CASE(JSOP_SETGLOBAL)
@@ -1532,8 +1532,9 @@ mjit::Compiler::emitReturn()
             Jump j = stubcc.masm.jump();
 
             /* if (arguments) ... */
-            Jump argsObj = masm.testObject(Assembler::Equal,
+            Jump argsObj = masm.branchPtr(Assembler::NotEqual,
-                                           Address(JSFrameReg, offsetof(JSStackFrame, argsval)));
+                                          Address(JSFrameReg, offsetof(JSStackFrame, argsobj)),
+                                          ImmIntPtr(0));
             stubcc.linkExit(argsObj);
             stubcc.call(stubs::PutArgsObject);
             stubcc.rejoin(0);
@@ -1767,7 +1768,7 @@ mjit::Compiler::compareTwoValues(JSContext *cx, JSOp op, const Value &lhs, const
     JS_ASSERT(rhs.isPrimitive());
 
     if (lhs.isString() && rhs.isString()) {
-        int cmp = js_CompareStrings(lhs.asString(), rhs.asString());
+        int cmp = js_CompareStrings(lhs.toString(), rhs.toString());
         switch (op) {
           case JSOP_LT:
             return cmp < 0;
@@ -1883,7 +1884,7 @@ mjit::Compiler::jsop_length()
 
     if (top->isTypeKnown() && top->getKnownType() == JSVAL_TYPE_STRING) {
         if (top->isConstant()) {
-            JSString *str = top->getValue().asString();
+            JSString *str = top->getValue().toString();
             Value v;
             v.setNumber(uint32(str->length()));
             frame.pop();
@@ -2512,7 +2513,7 @@ mjit::Compiler::jsop_propinc(JSOp op, VoidStubAtom stub, uint32 index)
         jsop_getprop(atom);
         // OBJ V
 
-        frame.push(Int32Tag(amt));
+        frame.push(Int32Value(amt));
         // OBJ V 1
 
         /* Use sub since it calls ValueToNumber instead of string concat. */
@@ -2539,7 +2540,7 @@ mjit::Compiler::jsop_propinc(JSOp op, VoidStubAtom stub, uint32 index)
         frame.dup();
         // OBJ N N
 
-        frame.push(Int32Tag(-amt));
+        frame.push(Int32Value(-amt));
         // OBJ N N 1
 
         jsop_binary(JSOP_ADD, stubs::Add);
@@ -2702,7 +2703,7 @@ void
 mjit::Compiler::jsop_bindgname()
 {
     if (script->compileAndGo && globalObj) {
-        frame.push(ObjectTag(*globalObj));
+        frame.push(ObjectValue(*globalObj));
         return;
     }
 
@@ -2729,7 +2730,7 @@ mjit::Compiler::jsop_getgname(uint32 index)
     mic.type = ic::MICInfo::GET;
     mic.entry = masm.label();
     if (fe->isConstant()) {
-        JSObject *obj = &fe->getValue().asObject();
+        JSObject *obj = &fe->getValue().toObject();
         frame.pop();
         JS_ASSERT(obj->isNative());
 
@@ -2805,7 +2806,7 @@ mjit::Compiler::jsop_setgname(uint32 index)
     mic.type = ic::MICInfo::SET;
     mic.entry = masm.label();
     if (objFe->isConstant()) {
-        JSObject *obj = &objFe->getValue().asObject();
+        JSObject *obj = &objFe->getValue().toObject();
         JS_ASSERT(obj->isNative());
 
         JSObjectMap *map = obj->map;
@@ -2972,7 +2973,7 @@ mjit::Compiler::jsop_instanceof()
     j = masm.branchTest32(Assembler::NonZero, temp, temp);
     stubcc.linkExit(j);
 
-    Address protoAddr(obj, offsetof(JSObject, fslots) + JSSLOT_PROTO * sizeof(Value));
+    Address protoAddr(obj, offsetof(JSObject, proto));
     Label loop = masm.label();
 
     /* Walk prototype chain, break out on NULL or hit. */

js/src/methodjit/FrameState.cpp

@@ -557,7 +557,7 @@ FrameState::copyInt32ConstantIntoReg(Assembler &masm, FrameEntry *fe)
         fe = fe->copyOf();
 
     RegisterID reg = allocReg();
-    masm.move(Imm32(fe->getValue().asInt32()), reg);
+    masm.move(Imm32(fe->getValue().toInt32()), reg);
     return reg;
 }
 

js/src/methodjit/InvokeHelpers.cpp

@@ -170,7 +170,7 @@ CreateFrame(VMFrame &f, uint32 flags, uint32 argc)
     JSContext *cx = f.cx;
     JSStackFrame *fp = f.fp;
     Value *vp = f.regs.sp - (argc + 2);
-    JSObject *funobj = &vp->asObject();
+    JSObject *funobj = &vp->toObject();
     JSFunction *fun = GET_FUNCTION_PRIVATE(cx, funobj);
 
     JS_ASSERT(FUN_INTERPRETED(fun));
@@ -204,14 +204,14 @@ CreateFrame(VMFrame &f, uint32 flags, uint32 argc)
     /* Initialize the frame. */
     newfp->ncode = NULL;
     newfp->callobj = NULL;
-    newfp->argsval.setNull();
+    newfp->argsobj = NULL;
     newfp->script = newscript;
     newfp->fun = fun;
     newfp->argc = argc;
     newfp->argv = vp + 2;
     newfp->rval.setUndefined();
     newfp->annotation = NULL;
-    newfp->scopeChain.setObject(*funobj->getParent());
+    newfp->scopeChain = funobj->getParent();
     newfp->flags = flags;
     newfp->blockChain = NULL;
     JS_ASSERT(!JSFUN_BOUND_METHOD_TEST(fun->flags));
@@ -271,7 +271,7 @@ InlineCall(VMFrame &f, uint32 flags, void **pret, uint32 argc)
     JSScript *script = fp->script;
     if (cx->options & JSOPTION_METHODJIT) {
         if (!script->ncode) {
-            if (mjit::TryCompile(cx, script, fp->fun, fp->scopeChainObj()) == Compile_Error)
+            if (mjit::TryCompile(cx, script, fp->fun, fp->scopeChain) == Compile_Error)
                 return false;
         }
         JS_ASSERT(script->ncode);
@@ -298,7 +298,7 @@ InlineReturn(JSContext *cx, JSBool ok)
     JSStackFrame *fp = cx->fp;
 
     JS_ASSERT(!fp->blockChain);
-    JS_ASSERT(!js_IsActiveWithOrBlock(cx, fp->scopeChainObj(), 0));
+    JS_ASSERT(!js_IsActiveWithOrBlock(cx, fp->scopeChain, 0));
 
     if (fp->script->staticLevel < JS_DISPLAY_SIZE)
         cx->display[fp->script->staticLevel] = fp->displaySave;
@@ -341,14 +341,14 @@ InlineConstruct(VMFrame &f, uint32 argc)
     JSContext *cx = f.cx;
     Value *vp = f.regs.sp - (argc + 2);
 
-    JSObject *funobj = &vp[0].asObject();
+    JSObject *funobj = &vp[0].toObject();
     JS_ASSERT(funobj->isFunction());
 
     jsid id = ATOM_TO_JSID(cx->runtime->atomState.classPrototypeAtom);
     if (!funobj->getProperty(cx, id, &vp[1]))
         return NULL;
 
-    JSObject *proto = vp[1].isObject() ? &vp[1].asObject() : NULL;
+    JSObject *proto = vp[1].isObject() ? &vp[1].toObject() : NULL;
     return NewObject(cx, &js_ObjectClass, proto, funobj->getParent());
 }
 
@@ -421,7 +421,7 @@ stubs::SlowNew(VMFrame &f, uint32 argc)
         }
     }
 
-    if (!InvokeConstructor(cx, InvokeArgsGuard(vp, argc), JS_TRUE))
+    if (!InvokeConstructor(cx, InvokeArgsGuard(vp, argc)))
         THROWV(NULL);
 
     return NULL;
@@ -433,7 +433,7 @@ CreateLightFrame(VMFrame &f, uint32 flags, uint32 argc)
     JSContext *cx = f.cx;
     JSStackFrame *fp = f.fp;
     Value *vp = f.regs.sp - (argc + 2);
-    JSObject *funobj = &vp->asObject();
+    JSObject *funobj = &vp->toObject();
     JSFunction *fun = GET_FUNCTION_PRIVATE(cx, funobj);
 
     JS_ASSERT(FUN_INTERPRETED(fun));
@@ -467,14 +467,14 @@ CreateLightFrame(VMFrame &f, uint32 flags, uint32 argc)
     /* Initialize the frame. */
     newfp->ncode = NULL;
     newfp->callobj = NULL;
-    newfp->argsval.setNull();
+    newfp->argsobj = NULL;
     newfp->script = newscript;
     newfp->fun = fun;
     newfp->argc = argc;
     newfp->argv = vp + 2;
     newfp->rval.setUndefined();
     newfp->annotation = NULL;
-    newfp->scopeChain.setObject(*funobj->getParent());
+    newfp->scopeChain = funobj->getParent();
     newfp->flags = flags;
     newfp->blockChain = NULL;
     JS_ASSERT(!JSFUN_BOUND_METHOD_TEST(fun->flags));
@@ -541,13 +541,12 @@ stubs::PutCallObject(VMFrame &f)
 {
     JS_ASSERT(f.fp->callobj);
     js_PutCallObject(f.cx, f.fp);
-    JS_ASSERT(f.fp->argsval.isNull());
+    JS_ASSERT(!f.fp->argsobj);
 }
 
 void JS_FASTCALL
 stubs::PutArgsObject(VMFrame &f)
 {
-    JS_ASSERT(f.fp->argsval.isObject());
     js_PutArgsObject(f.cx, f.fp);
 }
 

js/src/methodjit/MonoIC.cpp

@@ -60,7 +60,7 @@ PatchGetFallback(VMFrame &f, ic::MICInfo &mic)
 void JS_FASTCALL
 ic::GetGlobalName(VMFrame &f, uint32 index)
 {
-    JSObject *obj = f.fp->scopeChainObj()->getGlobal();
+    JSObject *obj = f.fp->scopeChain->getGlobal();
     ic::MICInfo &mic = f.fp->script->mics[index];
     JSAtom *atom = f.fp->script->getAtom(GET_INDEX(f.regs.pc));
     jsid id = ATOM_TO_JSID(atom);
@@ -135,7 +135,7 @@ PatchSetFallback(VMFrame &f, ic::MICInfo &mic)
 void JS_FASTCALL
 ic::SetGlobalName(VMFrame &f, uint32 index)
 {
-    JSObject *obj = f.fp->scopeChainObj()->getGlobal();
+    JSObject *obj = f.fp->scopeChain->getGlobal();
     ic::MICInfo &mic = f.fp->script->mics[index];
     JSAtom *atom = f.fp->script->getAtom(GET_INDEX(f.regs.pc));
     jsid id = ATOM_TO_JSID(atom);

js/src/methodjit/PolyIC.cpp

@@ -43,6 +43,7 @@
 #include "assembler/assembler/LinkBuffer.h"
 #include "jsscope.h"
 #include "jsnum.h"
+#include "jsobjinlines.h"
 #include "jsscopeinlines.h"
 #include "jspropertycache.h"
 #include "jspropertycacheinlines.h"
@@ -771,7 +772,7 @@ class GetPropCompiler : public PICStubCompiler
         if (obj != holder) {
             // Emit code that walks the prototype chain.
             JSObject *tempObj = obj;
-            Address fslot(pic.objReg, offsetof(JSObject, fslots) + JSSLOT_PROTO * sizeof(Value));
+            Address proto(pic.objReg, offsetof(JSObject, proto));
             do {
                 tempObj = tempObj->getProto();
                 // FIXME: we should find out why this condition occurs. It is probably
@@ -781,7 +782,7 @@ class GetPropCompiler : public PICStubCompiler
                 JS_ASSERT(tempObj);
                 JS_ASSERT(tempObj->isNative());
 
-                masm.loadData32(fslot, pic.objReg);
+                masm.loadData32(proto, pic.objReg);
                 pic.shapeRegHasBaseShape = false;
                 pic.u.get.objNeedsRemat = true;
 
@@ -1244,11 +1245,11 @@ ic::GetProp(VMFrame &f, uint32 index)
                 cc.disable("error");
                 THROW();
             }
-            JSString *str = f.regs.sp[-1].asString();
+            JSString *str = f.regs.sp[-1].toString();
             f.regs.sp[-1].setInt32(str->length());
             return;
         } else if (!f.regs.sp[-1].isPrimitive()) {
-            JSObject *obj = &f.regs.sp[-1].asObject();
+            JSObject *obj = &f.regs.sp[-1].toObject();
             if (obj->isArray()) {
                 GetPropCompiler cc(f, script, obj, pic, NULL, stubs::Length);
                 if (!cc.generateArrayLengthStub()) {
@@ -1397,7 +1398,7 @@ ic::CallProp(VMFrame &f, uint32 index)
         objv.setObject(*pobj);
     }
 
-    JSObject *aobj = js_GetProtoIfDenseArray(&objv.asObject());
+    JSObject *aobj = js_GetProtoIfDenseArray(&objv.toObject());
     Value rval;
 
     bool usePIC = true;
@@ -1416,7 +1417,7 @@ ic::CallProp(VMFrame &f, uint32 index)
         } else {
             JS_ASSERT(entry->vword.isSprop());
             JSScopeProperty *sprop = entry->vword.toSprop();
-            NATIVE_GET(cx, &objv.asObject(), obj2, sprop, JSGET_NO_METHOD_BARRIER, &rval,
+            NATIVE_GET(cx, &objv.toObject(), obj2, sprop, JSGET_NO_METHOD_BARRIER, &rval,
                        THROW());
         }
         regs.sp++;
@@ -1435,7 +1436,7 @@ ic::CallProp(VMFrame &f, uint32 index)
     regs.sp++;
     regs.sp[-1].setNull();
     if (lval.isObject()) {
-        if (!js_GetMethod(cx, &objv.asObject(), id,
+        if (!js_GetMethod(cx, &objv.toObject(), id,
                           JS_LIKELY(aobj->map->ops->getProperty == js_GetProperty)
                           ? JSGET_CACHE_RESULT | JSGET_NO_METHOD_BARRIER
                           : JSGET_NO_METHOD_BARRIER,
@@ -1445,8 +1446,8 @@ ic::CallProp(VMFrame &f, uint32 index)
         regs.sp[-1] = objv;
         regs.sp[-2] = rval;
     } else {
-        JS_ASSERT(objv.asObject().map->ops->getProperty == js_GetProperty);
+        JS_ASSERT(objv.toObject().map->ops->getProperty == js_GetProperty);
-        if (!js_GetPropertyHelper(cx, &objv.asObject(), id,
+        if (!js_GetPropertyHelper(cx, &objv.toObject(), id,
                                   JSGET_CACHE_RESULT | JSGET_NO_METHOD_BARRIER,
                                   &rval)) {
             THROW();
@@ -1468,7 +1469,7 @@ ic::CallProp(VMFrame &f, uint32 index)
         }
     }
 
-    GetPropCompiler cc(f, script, &objv.asObject(), pic, origAtom, CallPropSlow);
+    GetPropCompiler cc(f, script, &objv.toObject(), pic, origAtom, CallPropSlow);
     if (usePIC) {
         if (lval.isObject()) {
             if (!cc.update()) {
@@ -1509,7 +1510,7 @@ ic::Name(VMFrame &f, uint32 index)
     ic::PICInfo &pic = script->pics[index];
     JSAtom *atom = pic.atom;
 
-    ScopeNameCompiler cc(f, script, f.fp->scopeChainObj(), pic, atom, SlowName);
+    ScopeNameCompiler cc(f, script, f.fp->scopeChain, pic, atom, SlowName);
 
     if (!cc.update()) {
         cc.disable("error");
@@ -1544,7 +1545,7 @@ ic::BindName(VMFrame &f, uint32 index)
     ic::PICInfo &pic = script->pics[index];
     JSAtom *atom = pic.atom;
 
-    BindNameCompiler cc(f, script, f.fp->scopeChainObj(), pic, atom, SlowBindName);
+    BindNameCompiler cc(f, script, f.fp->scopeChain, pic, atom, SlowBindName);
 
     JSObject *obj = cc.update();
     if (!obj) {

js/src/methodjit/StubCalls-inl.h

@@ -62,10 +62,8 @@ static inline JSObject *
 ValueToObject(JSContext *cx, Value *vp)
 {
     if (vp->isObject())
-        return &vp->asObject();
+        return &vp->toObject();
-    if (!js_ValueToNonNullObject(cx, *vp, vp))
+    return js_ValueToNonNullObject(cx, *vp);
-        return NULL;
-    return &vp->asObject();
 }
 
 #define NATIVE_SET(cx,obj,sprop,entry,vp)                                     \

js/src/methodjit/StubCalls.cpp

@@ -79,16 +79,16 @@ mjit::stubs::BindName(VMFrame &f)
     PropertyCacheEntry *entry;
 
     /* Fast-path should have caught this. See comment in interpreter. */
-    JS_ASSERT(f.fp->scopeChainObj()->getParent());
+    JS_ASSERT(f.fp->scopeChain->getParent());
 
     JSAtom *atom;
     JSObject *obj2;
     JSContext *cx = f.cx;
-    JSObject *obj = f.fp->scopeChainObj();
+    JSObject *obj = f.fp->scopeChain;
     JS_PROPERTY_CACHE(cx).test(cx, f.regs.pc, obj, obj2, entry, atom);
     if (atom) {
         jsid id = ATOM_TO_JSID(atom);
-        obj = js_FindIdentifierBase(cx, f.fp->scopeChainObj(), id);
+        obj = js_FindIdentifierBase(cx, f.fp->scopeChain, id);
         if (!obj)
             THROW();
     }
@@ -99,7 +99,7 @@ mjit::stubs::BindName(VMFrame &f)
 JSObject * JS_FASTCALL
 mjit::stubs::BindGlobalName(VMFrame &f)
 {
-    return f.fp->scopeChainObj()->getGlobal();
+    return f.fp->scopeChain->getGlobal();
 }
 
 void JS_FASTCALL
@@ -219,8 +219,7 @@ mjit::stubs::SetName(VMFrame &f, JSAtom *origAtom)
                  * reserveSlots hook to allocate a number of reserved
                  * slots that may vary with obj.
                  */
-                if (slot < obj->numSlots() &&
+                if (slot < obj->numSlots()) {
-                    !obj->getClass()->reserveSlots) {
                     ++scope->freeslot;
                 } else {
                     if (!js_AllocSlot(cx, obj, &slot))
@@ -424,14 +423,14 @@ NameOp(VMFrame &f, JSObject *obj, bool callname = false)
 void JS_FASTCALL
 stubs::Name(VMFrame &f)
 {
-    if (!NameOp(f, f.fp->scopeChainObj()))
+    if (!NameOp(f, f.fp->scopeChain))
         THROW();
 }
 
 void JS_FASTCALL
 stubs::GetGlobalName(VMFrame &f)
 {
-    JSObject *globalObj = f.fp->scopeChainObj()->getGlobal();
+    JSObject *globalObj = f.fp->scopeChain->getGlobal();
     if (!NameOp(f, globalObj))
          THROW();
 }
@@ -442,16 +441,16 @@ IteratorNext(JSContext *cx, JSObject *iterobj, Value *rval)
     if (iterobj->getClass() == &js_IteratorClass.base) {
         NativeIterator *ni = (NativeIterator *) iterobj->getPrivate();
         JS_ASSERT(ni->props_cursor < ni->props_end);
-        if ((ni->flags & JSITER_FOREACH) == 0) {
+        if (ni->isKeyIter()) {
-            jsid id = ni->currentId();
+            jsid id = *ni->currentKey();
             if (JSID_IS_ATOM(id)) {
                 rval->setString(JSID_TO_STRING(id));
-                ni->incIdCursor();
+                ni->incKeyCursor();
                 return true;
             }
             /* Take the slow path if we have to stringify a numeric property name. */
         } else {
-            *rval = ni->currentValue();
+            *rval = *ni->currentValue();
             ni->incValueCursor();
             return true;
         }
@@ -476,7 +475,7 @@ stubs::ForName(VMFrame &f, JSAtom *atom)
     {
         AutoValueRooter tvr(cx);
         JS_ASSERT(regs.sp[-1].isObject());
-        if (!IteratorNext(cx, &regs.sp[-1].asObject(), tvr.addr()))
+        if (!IteratorNext(cx, &regs.sp[-1].toObject(), tvr.addr()))
             THROW();
         if (!obj->setProperty(cx, id, tvr.addr()))
             THROW();
@@ -499,8 +498,8 @@ stubs::GetElem(VMFrame &f)
 
     if (lval.isString() && rval.isInt32()) {
         Value retval;
-        JSString *str = lval.asString();
+        JSString *str = lval.toString();
-        i = rval.asInt32();
+        i = rval.toInt32();
 
         if ((size_t)i >= str->length())
             THROW();
@@ -518,7 +517,7 @@ stubs::GetElem(VMFrame &f)
 
     if (rval.isInt32()) {
         if (obj->isDenseArray()) {
-            jsuint idx = jsuint(rval.asInt32());
+            jsuint idx = jsuint(rval.toInt32());
             
             if (idx < obj->getArrayLength() &&
                 idx < obj->getDenseArrayCapacity()) {
@@ -532,7 +531,7 @@ stubs::GetElem(VMFrame &f)
                    && !GetArgsPrivateNative(obj)
 #endif
                   ) {
-            uint32 arg = uint32(rval.asInt32());
+            uint32 arg = uint32(rval.toInt32());
 
             if (arg < obj->getArgsLength()) {
                 JSStackFrame *afp = (JSStackFrame *) obj->getPrivate();
@@ -547,7 +546,7 @@ stubs::GetElem(VMFrame &f)
                 /* Otherwise, fall to getProperty(). */
             }
         }
-        id = INT_TO_JSID(rval.asInt32());
+        id = INT_TO_JSID(rval.toInt32());
 
     } else {
         if (!js_InternNonIntElementId(cx, obj, rval, &id))
@@ -658,7 +657,7 @@ stubs::SetElem(VMFrame &f)
 void JS_FASTCALL
 stubs::CallName(VMFrame &f)
 {
-    JSObject *obj = NameOp(f, f.fp->scopeChainObj(), true);
+    JSObject *obj = NameOp(f, f.fp->scopeChain, true);
     if (!obj)
         THROW();
 }
@@ -835,7 +834,7 @@ stubs::DefFun(VMFrame &f, uint32 index)
          * FIXME: bug 476950, although debugger users may also demand some kind
          * of scope link for debugger-assisted eval-in-frame.
          */
-        obj2 = fp->scopeChainObj();
+        obj2 = fp->scopeChain;
     } else {
         JS_ASSERT(!FUN_FLAT_CLOSURE(fun));
 
@@ -844,7 +843,7 @@ stubs::DefFun(VMFrame &f, uint32 index)
          * top-level function.
          */
         if (!fp->blockChain) {
-            obj2 = fp->scopeChainObj();
+            obj2 = fp->scopeChain;
         } else {
             obj2 = js_GetScopeChain(cx, fp);
             if (!obj2)
@@ -873,7 +872,7 @@ stubs::DefFun(VMFrame &f, uint32 index)
      * fp->scopeChain code below the parent->defineProperty call.
      */
     MUST_FLOW_THROUGH("restore_scope");
-    fp->setScopeChainObj(obj);
+    fp->scopeChain = obj;
 
     Value rval;
     rval.setObject(*obj);
@@ -966,7 +965,7 @@ stubs::DefFun(VMFrame &f, uint32 index)
 
   restore_scope:
     /* Restore fp->scopeChain now that obj is defined in fp->callobj. */
-    fp->setScopeChainObj(obj2);
+    fp->scopeChain = obj2;
     if (!ok)
         THROW();
 }
@@ -975,7 +974,7 @@ stubs::DefFun(VMFrame &f, uint32 index)
     JS_BEGIN_MACRO                                                            \
         JS_ASSERT(v.isObject());                                              \
         JS_ASSERT(v == regs.sp[n]);                                           \
-        if (!v.asObject().defaultValue(cx, hint, &regs.sp[n]))                \
+        if (!v.toObject().defaultValue(cx, hint, &regs.sp[n]))                \
             THROWV(JS_FALSE);                                                 \
         v = regs.sp[n];                                                       \
     JS_END_MACRO
@@ -992,7 +991,7 @@ stubs::DefFun(VMFrame &f, uint32 index)
         if (rval.isObject())                                                  \
             DEFAULT_VALUE(cx, -1, JSTYPE_NUMBER, rval);                       \
         if (lval.isString() && rval.isString()) {                             \
-            JSString *l = lval.asString(), *r = rval.asString();              \
+            JSString *l = lval.toString(), *r = rval.toString();              \
             cond = js_CompareStrings(l, r) OP 0;                              \
         } else {                                                              \
             double l, r;                                                      \
@@ -1057,8 +1056,8 @@ StubEqualityOp(VMFrame &f)
     JSBool cond;
 
 #if JS_HAS_XML_SUPPORT
-    if ((lval.isObject() && lval.asObject().isXML()) ||
+    if ((lval.isObject() && lval.toObject().isXML()) ||
-        (rval.isObject() && rval.asObject().isXML())) {
+        (rval.isObject() && rval.toObject().isXML())) {
         if (!js_TestXMLEquality(cx, lval, rval, &cond))
             return false;
         cond = cond == EQ;
@@ -1067,18 +1066,18 @@ StubEqualityOp(VMFrame &f)
 
     if (SameType(lval, rval)) {
         if (lval.isString()) {
-            JSString *l = lval.asString();
+            JSString *l = lval.toString();
-            JSString *r = rval.asString();
+            JSString *r = rval.toString();
             cond = js_EqualStrings(l, r) == EQ;
         } else if (lval.isDouble()) {
-            double l = lval.asDouble();
+            double l = lval.toDouble();
-            double r = rval.asDouble();
+            double r = rval.toDouble();
             if (EQ)
                 cond = JSDOUBLE_COMPARE(l, ==, r, IFNAN);
             else
                 cond = JSDOUBLE_COMPARE(l, !=, r, IFNAN);
         } else if (lval.isObject()) {
-            JSObject *l = &lval.asObject(), *r = &rval.asObject();
+            JSObject *l = &lval.toObject(), *r = &rval.toObject();
             if (((clasp = l->getClass())->flags & JSCLASS_IS_EXTENDED) &&
                 ((ExtendedClass  *)clasp)->equality) {
                 if (!((ExtendedClass *)clasp)->equality(cx, l, &rval, &cond))
@@ -1088,7 +1087,7 @@ StubEqualityOp(VMFrame &f)
                 cond = (l == r) == EQ;
             }
         } else {
-            cond = (lval.asRawUint32() == rval.asRawUint32()) == EQ;
+            cond = (lval.payloadAsRawUint32() == rval.payloadAsRawUint32()) == EQ;
         }
     } else {
         if (lval.isNullOrUndefined()) {
@@ -1097,20 +1096,20 @@ StubEqualityOp(VMFrame &f)
             cond = !EQ;
         } else {
             if (lval.isObject()) {
-                if (!lval.asObject().defaultValue(cx, JSTYPE_VOID, &regs.sp[-2]))
+                if (!lval.toObject().defaultValue(cx, JSTYPE_VOID, &regs.sp[-2]))
                     return false;
                 lval = regs.sp[-2];
             }
 
             if (rval.isObject()) {
-                if (!rval.asObject().defaultValue(cx, JSTYPE_VOID, &regs.sp[-1]))
+                if (!rval.toObject().defaultValue(cx, JSTYPE_VOID, &regs.sp[-1]))
                     return false;
                 rval = regs.sp[-1];
             }
 
             if (lval.isString() && rval.isString()) {
-                JSString *l = lval.asString();
+                JSString *l = lval.toString();
-                JSString *r = rval.asString();
+                JSString *r = rval.toString();
                 cond = js_EqualStrings(l, r) == EQ;
             } else {
                 double l, r;
@@ -1136,7 +1135,7 @@ stubs::Equal(VMFrame &f)
 {
     if (!StubEqualityOp<JS_TRUE, false>(f))
         THROWV(JS_FALSE);
-    return f.regs.sp[-2].asBoolean();
+    return f.regs.sp[-2].toBoolean();
 }
 
 JSBool JS_FASTCALL
@@ -1144,14 +1143,14 @@ stubs::NotEqual(VMFrame &f)
 {
     if (!StubEqualityOp<JS_FALSE, true>(f))
         THROWV(JS_FALSE);
-    return f.regs.sp[-2].asBoolean();
+    return f.regs.sp[-2].toBoolean();
 }
 
 static inline bool
 DefaultValue(VMFrame &f, JSType hint, Value &v, int n)
 {
     JS_ASSERT(v.isObject());
-    if (!v.asObject().defaultValue(f.cx, hint, &f.regs.sp[n]))
+    if (!v.toObject().defaultValue(f.cx, hint, &f.regs.sp[n]))
         return false;
     v = f.regs.sp[n];
     return true;
@@ -1166,7 +1165,7 @@ stubs::Add(VMFrame &f)
     Value lval = regs.sp[-2];
 
     if (lval.isInt32() && rval.isInt32()) {
-        int32_t l = lval.asInt32(), r = rval.asInt32();
+        int32_t l = lval.toInt32(), r = rval.toInt32();
         int32_t sum = l + r;
         regs.sp--;
         if (JS_UNLIKELY(bool((l ^ sum) & (r ^ sum) & 0x80000000)))
@@ -1175,9 +1174,9 @@ stubs::Add(VMFrame &f)
             regs.sp[-1].setInt32(sum);
     } else
 #if JS_HAS_XML_SUPPORT
-    if (lval.isObject() && lval.asObject().isXML() &&
+    if (lval.isObject() && lval.toObject().isXML() &&
-        rval.isObject() && rval.asObject().isXML()) {
+        rval.isObject() && rval.toObject().isXML()) {
-        if (!js_ConcatenateXML(cx, &lval.asObject(), &rval.asObject(), &rval))
+        if (!js_ConcatenateXML(cx, &lval.toObject(), &rval.toObject(), &rval))
             THROW();
         regs.sp--;
         regs.sp[-1] = rval;
@@ -1192,7 +1191,7 @@ stubs::Add(VMFrame &f)
         if ((lIsString = lval.isString()) | (rIsString = rval.isString())) {
             JSString *lstr, *rstr;
             if (lIsString) {
-                lstr = lval.asString();
+                lstr = lval.toString();
             } else {
                 lstr = js_ValueToString(cx, lval);
                 if (!lstr)
@@ -1200,7 +1199,7 @@ stubs::Add(VMFrame &f)
                 regs.sp[-2].setString(lstr);
             }
             if (rIsString) {
-                rstr = rval.asString();
+                rstr = rval.toString();
             } else {
                 rstr = js_ValueToString(cx, rval);
                 if (!rstr)
@@ -1295,7 +1294,7 @@ stubs::Mod(VMFrame &f)
     Value &rref = regs.sp[-1];
     int32_t l, r;
     if (lref.isInt32() && rref.isInt32() &&
-        (l = lref.asInt32()) >= 0 && (r = rref.asInt32()) > 0) {
+        (l = lref.toInt32()) >= 0 && (r = rref.toInt32()) > 0) {
         int32_t mod = l % r;
         regs.sp[-2].setInt32(mod);
     } else {
@@ -1418,7 +1417,7 @@ stubs::InitElem(VMFrame &f, uint32 last)
     /* Find the object being initialized at top of stack. */
     const Value &lref = regs.sp[-3];
     JS_ASSERT(lref.isObject());
-    JSObject *obj = &lref.asObject();
+    JSObject *obj = &lref.toObject();
 
     /* Fetch id now that we have obj. */
     jsid id;
@@ -1451,10 +1450,12 @@ stubs::InitElem(VMFrame &f, uint32 last)
 }
 
 void JS_FASTCALL
-stubs::GetUpvar(VMFrame &f, uint32 cookie)
+stubs::GetUpvar(VMFrame &f, uint32 ck)
 {
     /* :FIXME: We can do better, this stub isn't needed. */
     uint32 staticLevel = f.fp->script->staticLevel;
+    UpvarCookie cookie;
+    cookie.fromInteger(ck);
     f.regs.sp[0] = js_GetUpvar(f.cx, staticLevel, cookie);
 }
 
@@ -1473,7 +1474,7 @@ stubs::DefLocalFun(VMFrame &f, JSFunction *fun)
     JSObject *obj = FUN_OBJECT(fun);
 
     if (FUN_NULL_CLOSURE(fun)) {
-        obj = CloneFunctionObject(f.cx, fun, f.fp->scopeChainObj());
+        obj = CloneFunctionObject(f.cx, fun, f.fp->scopeChain);
         if (!obj)
             THROWV(NULL);
     } else {
@@ -1512,7 +1513,7 @@ stubs::RegExp(VMFrame &f, JSObject *regex)
      * js_GetClassPrototype uses the latter only to locate the global.
      */
     JSObject *proto;
-    if (!js_GetClassPrototype(f.cx, f.fp->scopeChainObj(), JSProto_RegExp, &proto))
+    if (!js_GetClassPrototype(f.cx, f.fp->scopeChain, JSProto_RegExp, &proto))
         THROWV(NULL);
     JS_ASSERT(proto);
     JSObject *obj = js_CloneRegExpObject(f.cx, regex, proto);
@@ -1528,7 +1529,7 @@ stubs::Lambda(VMFrame &f, JSFunction *fun)
 
     JSObject *parent;
     if (FUN_NULL_CLOSURE(fun)) {
-        parent = f.fp->scopeChainObj();
+        parent = f.fp->scopeChain;
     } else {
         parent = js_GetScopeChain(f.cx, f.fp);
         if (!parent)
@@ -1563,11 +1564,11 @@ ObjIncOp(VMFrame &f, JSObject *obj, jsid id)
 
     Value &ref = f.regs.sp[-1];
     int32_t tmp;
-    if (JS_LIKELY(ref.isInt32() && CanIncDecWithoutOverflow(tmp = ref.asInt32()))) {
+    if (JS_LIKELY(ref.isInt32() && CanIncDecWithoutOverflow(tmp = ref.toInt32()))) {
         if (POST)
-            ref.asInt32Ref() = tmp + N;
+            ref.getInt32Ref() = tmp + N;
         else
-            ref.asInt32Ref() = tmp += N;
+            ref.getInt32Ref() = tmp += N;
         fp->flags |= JSFRAME_ASSIGNING;
         JSBool ok = obj->setProperty(cx, id, &ref);
         fp->flags &= ~JSFRAME_ASSIGNING;
@@ -1619,11 +1620,11 @@ NameIncDec(VMFrame &f, JSObject *obj, JSAtom *origAtom)
             JS_ASSERT(slot < obj->scope()->freeslot);
             Value &rref = obj->getSlotRef(slot);
             int32_t tmp;
-            if (JS_LIKELY(rref.isInt32() && CanIncDecWithoutOverflow(tmp = rref.asInt32()))) {
+            if (JS_LIKELY(rref.isInt32() && CanIncDecWithoutOverflow(tmp = rref.toInt32()))) {
                 int32_t inc = tmp + N;
                 if (!POST)
                     tmp = inc;
-                rref.asInt32Ref() = inc;
+                rref.getInt32Ref() = inc;
                 f.regs.sp[0].setInt32(tmp);
                 return true;
             }
@@ -1745,7 +1746,7 @@ stubs::DecElem(VMFrame &f)
 void JS_FASTCALL
 stubs::NameInc(VMFrame &f, JSAtom *atom)
 {
-    JSObject *obj = f.fp->scopeChainObj();
+    JSObject *obj = f.fp->scopeChain;
     if (!NameIncDec<1, true>(f, obj, atom))
         THROW();
 }
@@ -1753,7 +1754,7 @@ stubs::NameInc(VMFrame &f, JSAtom *atom)
 void JS_FASTCALL
 stubs::NameDec(VMFrame &f, JSAtom *atom)
 {
-    JSObject *obj = f.fp->scopeChainObj();
+    JSObject *obj = f.fp->scopeChain;
     if (!NameIncDec<-1, true>(f, obj, atom))
         THROW();
 }
@@ -1761,7 +1762,7 @@ stubs::NameDec(VMFrame &f, JSAtom *atom)
 void JS_FASTCALL
 stubs::IncName(VMFrame &f, JSAtom *atom)
 {
-    JSObject *obj = f.fp->scopeChainObj();
+    JSObject *obj = f.fp->scopeChain;
     if (!NameIncDec<1, false>(f, obj, atom))
         THROW();
 }
@@ -1769,7 +1770,7 @@ stubs::IncName(VMFrame &f, JSAtom *atom)
 void JS_FASTCALL
 stubs::DecName(VMFrame &f, JSAtom *atom)
 {
-    JSObject *obj = f.fp->scopeChainObj();
+    JSObject *obj = f.fp->scopeChain;
     if (!NameIncDec<-1, false>(f, obj, atom))
         THROW();
 }
@@ -1777,7 +1778,7 @@ stubs::DecName(VMFrame &f, JSAtom *atom)
 void JS_FASTCALL
 stubs::GlobalNameInc(VMFrame &f, JSAtom *atom)
 {
-    JSObject *obj = f.fp->scopeChainObj()->getGlobal();
+    JSObject *obj = f.fp->scopeChain->getGlobal();
     if (!NameIncDec<1, true>(f, obj, atom))
         THROW();
 }
@@ -1785,7 +1786,7 @@ stubs::GlobalNameInc(VMFrame &f, JSAtom *atom)
 void JS_FASTCALL
 stubs::GlobalNameDec(VMFrame &f, JSAtom *atom)
 {
-    JSObject *obj = f.fp->scopeChainObj()->getGlobal();
+    JSObject *obj = f.fp->scopeChain->getGlobal();
     if (!NameIncDec<-1, true>(f, obj, atom))
         THROW();
 }
@@ -1793,7 +1794,7 @@ stubs::GlobalNameDec(VMFrame &f, JSAtom *atom)
 void JS_FASTCALL
 stubs::IncGlobalName(VMFrame &f, JSAtom *atom)
 {
-    JSObject *obj = f.fp->scopeChainObj()->getGlobal();
+    JSObject *obj = f.fp->scopeChain->getGlobal();
     if (!NameIncDec<1, false>(f, obj, atom))
         THROW();
 }
@@ -1801,7 +1802,7 @@ stubs::IncGlobalName(VMFrame &f, JSAtom *atom)
 void JS_FASTCALL
 stubs::DecGlobalName(VMFrame &f, JSAtom *atom)
 {
-    JSObject *obj = f.fp->scopeChainObj()->getGlobal();
+    JSObject *obj = f.fp->scopeChain->getGlobal();
     if (!NameIncDec<-1, false>(f, obj, atom))
         THROW();
 }
@@ -1901,7 +1902,7 @@ stubs::CallProp(VMFrame &f, JSAtom *origAtom)
         objv.setObject(*pobj);
     }
 
-    JSObject *aobj = js_GetProtoIfDenseArray(&objv.asObject());
+    JSObject *aobj = js_GetProtoIfDenseArray(&objv.toObject());
     Value rval;
 
     PropertyCacheEntry *entry;
@@ -1918,7 +1919,7 @@ stubs::CallProp(VMFrame &f, JSAtom *origAtom)
         } else {
             JS_ASSERT(entry->vword.isSprop());
             JSScopeProperty *sprop = entry->vword.toSprop();
-            NATIVE_GET(cx, &objv.asObject(), obj2, sprop, JSGET_NO_METHOD_BARRIER, &rval,
+            NATIVE_GET(cx, &objv.toObject(), obj2, sprop, JSGET_NO_METHOD_BARRIER, &rval,
                        THROW());
         }
         regs.sp++;
@@ -1937,7 +1938,7 @@ stubs::CallProp(VMFrame &f, JSAtom *origAtom)
     regs.sp++;
     regs.sp[-1].setNull();
     if (lval.isObject()) {
-        if (!js_GetMethod(cx, &objv.asObject(), id,
+        if (!js_GetMethod(cx, &objv.toObject(), id,
                           JS_LIKELY(aobj->map->ops->getProperty == js_GetProperty)
                           ? JSGET_CACHE_RESULT | JSGET_NO_METHOD_BARRIER
                           : JSGET_NO_METHOD_BARRIER,
@@ -1947,8 +1948,8 @@ stubs::CallProp(VMFrame &f, JSAtom *origAtom)
         regs.sp[-1] = objv;
         regs.sp[-2] = rval;
     } else {
-        JS_ASSERT(objv.asObject().map->ops->getProperty == js_GetProperty);
+        JS_ASSERT(objv.toObject().map->ops->getProperty == js_GetProperty);
-        if (!js_GetPropertyHelper(cx, &objv.asObject(), id,
+        if (!js_GetPropertyHelper(cx, &objv.toObject(), id,
                                   JSGET_CACHE_RESULT | JSGET_NO_METHOD_BARRIER,
                                   &rval)) {
             THROW();
@@ -2002,10 +2003,10 @@ stubs::Length(VMFrame &f)
     Value *vp = &regs.sp[-1];
 
     if (vp->isString()) {
-        vp->setInt32(vp->asString()->length());
+        vp->setInt32(vp->toString()->length());
         return;
     } else if (vp->isObject()) {
-        JSObject *obj = &vp->asObject();
+        JSObject *obj = &vp->toObject();
         if (obj->isArray()) {
             jsuint length = obj->getArrayLength();
             regs.sp[-1].setDouble(length);
@@ -2043,9 +2044,8 @@ InitPropOrMethod(VMFrame &f, JSAtom *atom, JSOp op)
     rval = regs.sp[-1];
 
     /* Load the object being initialized into lval/obj. */
-    JSObject *obj = &regs.sp[-2].asObject();
+    JSObject *obj = &regs.sp[-2].toObject();
     JS_ASSERT(obj->isNative());
-    JS_ASSERT(!obj->getClass()->reserveSlots);
 
     JSScope *scope = obj->scope();
 
@@ -2141,7 +2141,7 @@ stubs::IterNext(VMFrame &f)
     JS_ASSERT(f.regs.sp - 1 >= f.fp->base());
     JS_ASSERT(f.regs.sp[-1].isObject());
 
-    JSObject *iterobj = &f.regs.sp[-1].asObject();
+    JSObject *iterobj = &f.regs.sp[-1].toObject();
     f.regs.sp[0].setNull();
     f.regs.sp++;
     if (!js_IteratorNext(f.cx, iterobj, &f.regs.sp[-1]))
@@ -2155,11 +2155,11 @@ stubs::IterMore(VMFrame &f)
     JS_ASSERT(f.regs.sp[-1].isObject());
 
     Value v;
-    JSObject *iterobj = &f.regs.sp[-1].asObject();
+    JSObject *iterobj = &f.regs.sp[-1].toObject();
     if (!js_IteratorMore(f.cx, iterobj, &v))
         THROWV(JS_FALSE);
 
-    return v.asBoolean();
+    return v.toBoolean();
 }
 
 void JS_FASTCALL
@@ -2247,7 +2247,7 @@ stubs::InstanceOf(VMFrame &f)
     const Value &rref = regs.sp[-1];
     JSObject *obj;
     if (rref.isPrimitive() ||
-        !(obj = &rref.asObject())->map->ops->hasInstance) {
+        !(obj = &rref.toObject())->map->ops->hasInstance) {
         js_ReportValueError(cx, JSMSG_BAD_INSTANCEOF_RHS,
                             -1, rref, NULL);
         THROWV(JS_FALSE);
@@ -2274,7 +2274,7 @@ stubs::FastInstanceOf(VMFrame &f)
         THROW();
     }
 
-    f.regs.sp[-3].setBoolean(js_IsDelegate(f.cx, &lref.asObject(), f.regs.sp[-3]));
+    f.regs.sp[-3].setBoolean(js_IsDelegate(f.cx, &lref.toObject(), f.regs.sp[-3]));
 }
 
 void JS_FASTCALL
@@ -2315,7 +2315,7 @@ stubs::EnterBlock(VMFrame &f, JSObject *obj)
      * anything else we should have popped off fp->scopeChain when we left its
      * static scope.
      */
-    JSObject *obj2 = fp->scopeChainObj();
+    JSObject *obj2 = fp->scopeChain;
     Class *clasp;
     while ((clasp = obj2->getClass()) == &js_WithClass)
         obj2 = obj2->getParent();
@@ -2349,7 +2349,7 @@ stubs::LeaveBlock(VMFrame &f)
      * cloned onto fp->scopeChain, clear its private data, move its locals from
      * the stack into the clone, and pop it off the chain.
      */
-    JSObject *obj = fp->scopeChainObj();
+    JSObject *obj = fp->scopeChain;
     if (obj->getProto() == fp->blockChain) {
         JS_ASSERT(obj->getClass() == &js_BlockClass);
         if (!js_PutBlockObject(cx, JS_TRUE))
@@ -2384,12 +2384,12 @@ stubs::LookupSwitch(VMFrame &f, jsbytecode *pc)
     JS_ASSERT(npairs);
 
     if (lval.isString()) {
-        JSString *str = lval.asString();
+        JSString *str = lval.toString();
         for (uint32 i = 1; i <= npairs; i++) {
             Value rval = script->getConst(GET_INDEX(pc));
             pc += INDEX_LEN;
             if (rval.isString()) {
-                JSString *rhs = rval.asString();
+                JSString *rhs = rval.toString();
                 if (rhs == str || js_EqualStrings(str, rhs)) {
                     ptrdiff_t offs = (jpc + GET_JUMP_OFFSET(pc)) - script->code;
                     JS_ASSERT(script->nmap[offs]);
@@ -2399,11 +2399,11 @@ stubs::LookupSwitch(VMFrame &f, jsbytecode *pc)
             pc += JUMP_OFFSET_LEN;
         }
     } else if (lval.isNumber()) {
-        double d = lval.asNumber();
+        double d = lval.toNumber();
         for (uint32 i = 1; i <= npairs; i++) {
             Value rval = script->getConst(GET_INDEX(pc));
             pc += INDEX_LEN;
-            if (rval.isNumber() && d == rval.asNumber()) {
+            if (rval.isNumber() && d == rval.toNumber()) {
                 ptrdiff_t offs = (jpc + GET_JUMP_OFFSET(pc)) - script->code;
                 JS_ASSERT(script->nmap[offs]);
                 return script->nmap[offs];
@@ -2442,9 +2442,9 @@ stubs::TableSwitch(VMFrame &f, jsbytecode *origPc)
 
     jsint tableIdx;
     if (rval.isInt32()) {
-        tableIdx = rval.asInt32();
+        tableIdx = rval.toInt32();
     } else if (rval.isDouble()) {
-        double d = rval.asDouble();
+        double d = rval.toDouble();
         if (d == 0) {
             /* Treat -0 (double) as 0. */
             tableIdx = 0;
@@ -2480,7 +2480,7 @@ finally:
 void JS_FASTCALL
 stubs::Unbrand(VMFrame &f)
 {
-    if (!f.regs.sp[-1].asObject().unbrand(f.cx))
+    if (!f.regs.sp[-1].toObject().unbrand(f.cx))
         THROW();
 }
 

js/src/methodjit/nunbox/FastArithmetic.cpp

@@ -87,9 +87,9 @@ JSOpBinaryTryConstantFold(JSContext *cx, FrameState &frame, JSOp op, FrameEntry
             if (dL == 0 || JSDOUBLE_IS_NaN(dL))
                 dL = js_NaN;
             else if (JSDOUBLE_IS_NEG(dL) != JSDOUBLE_IS_NEG(dR))
-                dL = cx->runtime->negativeInfinityValue.asDouble();
+                dL = cx->runtime->negativeInfinityValue.toDouble();
             else
-                dL = cx->runtime->positiveInfinityValue.asDouble();
+                dL = cx->runtime->positiveInfinityValue.toDouble();
         } else {
             dL /= dR;
         }
@@ -145,7 +145,7 @@ mjit::Compiler::jsop_binary_intmath(JSOp op, RegisterID *returnReg, MaybeJump &j
       case JSOP_ADD:
         if (rhs->isConstant()) {
             fail = masm.branchAdd32(Assembler::Overflow,
-                                    Imm32(rhs->getValue().asInt32()), reg);
+                                    Imm32(rhs->getValue().toInt32()), reg);
         } else if (frame.shouldAvoidDataRemat(rhs)) {
             fail = masm.branchAdd32(Assembler::Overflow,
                                     frame.addressOf(rhs), reg);
@@ -159,7 +159,7 @@ mjit::Compiler::jsop_binary_intmath(JSOp op, RegisterID *returnReg, MaybeJump &j
       case JSOP_SUB:
         if (rhs->isConstant()) {
             fail = masm.branchSub32(Assembler::Overflow,
-                                    Imm32(rhs->getValue().asInt32()), reg);
+                                    Imm32(rhs->getValue().toInt32()), reg);
         } else if (frame.shouldAvoidDataRemat(rhs)) {
             fail = masm.branchSub32(Assembler::Overflow,
                                     frame.addressOf(rhs), reg);
@@ -231,9 +231,9 @@ mjit::Compiler::slowLoadConstantDouble(Assembler &masm,
 {
     jsdpun u;
     if (fe->getKnownType() == JSVAL_TYPE_INT32)
-        u.d = (double)fe->getValue().asInt32();
+        u.d = (double)fe->getValue().toInt32();
     else
-        u.d = fe->getValue().asDouble();
+        u.d = fe->getValue().toDouble();
 
     masm.storeData32(Imm32(u.s.lo), frame.addressOf(fe));
     masm.storeTypeTag(ImmTag(JSValueTag(u.s.hi)), frame.addressOf(fe));

js/src/methodjit/nunbox/FastOps.cpp

@@ -145,25 +145,25 @@ mjit::Compiler::jsop_bitop(JSOp op)
     }
 
     if (lhs->isConstant() && rhs->isConstant()) {
-        int32 L = lhs->getValue().asInt32();
+        int32 L = lhs->getValue().toInt32();
-        int32 R = rhs->getValue().asInt32();
+        int32 R = rhs->getValue().toInt32();
 
         frame.popn(2);
         switch (op) {
           case JSOP_BITOR:
-            frame.push(Int32Tag(L | R));
+            frame.push(Int32Value(L | R));
             return;
           case JSOP_BITXOR:
-            frame.push(Int32Tag(L ^ R));
+            frame.push(Int32Value(L ^ R));
             return;
           case JSOP_BITAND:
-            frame.push(Int32Tag(L & R));
+            frame.push(Int32Value(L & R));
             return;
           case JSOP_LSH:
-            frame.push(Int32Tag(L << R));
+            frame.push(Int32Value(L << R));
             return;
           case JSOP_RSH:
-            frame.push(Int32Tag(L >> R));
+            frame.push(Int32Value(L >> R));
             return;
           default:
             JS_NOT_REACHED("say wat");
@@ -188,11 +188,11 @@ mjit::Compiler::jsop_bitop(JSOp op)
         reg = frame.ownRegForData(lhs);
         if (rhs->isConstant()) {
             if (op == JSOP_BITAND)
-                masm.and32(Imm32(rhs->getValue().asInt32()), reg);
+                masm.and32(Imm32(rhs->getValue().toInt32()), reg);
             else if (op == JSOP_BITXOR)
-                masm.xor32(Imm32(rhs->getValue().asInt32()), reg);
+                masm.xor32(Imm32(rhs->getValue().toInt32()), reg);
             else
-                masm.or32(Imm32(rhs->getValue().asInt32()), reg);
+                masm.or32(Imm32(rhs->getValue().toInt32()), reg);
         } else if (frame.shouldAvoidDataRemat(rhs)) {
             if (op == JSOP_BITAND)
                 masm.and32(masm.payloadOf(frame.addressOf(rhs)), reg);
@@ -218,7 +218,7 @@ mjit::Compiler::jsop_bitop(JSOp op)
       {
         /* Not commutative. */
         if (rhs->isConstant()) {
-            int32 shift = rhs->getValue().asInt32() & 0x1F;
+            int32 shift = rhs->getValue().toInt32() & 0x1F;
 
             reg = frame.ownRegForData(lhs);
 
@@ -255,7 +255,7 @@ mjit::Compiler::jsop_bitop(JSOp op)
             frame.pinReg(rr);
             if (lhs->isConstant()) {
                 reg = frame.allocReg();
-                masm.move(Imm32(lhs->getValue().asInt32()), reg);
+                masm.move(Imm32(lhs->getValue().toInt32()), reg);
             } else {
                 reg = frame.ownRegForData(lhs);
             }
@@ -515,7 +515,7 @@ mjit::Compiler::jsop_relational(JSOp op, BoolStub stub, jsbytecode *target, JSOp
         if (!(rhsConst = rhs->isConstant()))
             rr = frame.ownRegForData(rhs);
         else
-            rval = rhs->getValue().asInt32();
+            rval = rhs->getValue().toInt32();
 
         frame.pop();
         frame.pop();
@@ -587,7 +587,7 @@ mjit::Compiler::jsop_relational(JSOp op, BoolStub stub, jsbytecode *target, JSOp
 
         /* Emit the compare & set. */
         if (rhs->isConstant()) {
-            masm.set32(cond, reg, Imm32(rhs->getValue().asInt32()), resultReg);
+            masm.set32(cond, reg, Imm32(rhs->getValue().toInt32()), resultReg);
         } else if (frame.shouldAvoidDataRemat(rhs)) {
             masm.set32(cond, reg,
                        masm.payloadOf(frame.addressOf(rhs)),
@@ -641,7 +641,7 @@ mjit::Compiler::jsop_not()
     if (top->isConstant()) {
         const Value &v = top->getValue();
         frame.pop();
-        frame.push(BooleanTag(!js_ValueToBoolean(v)));
+        frame.push(BooleanValue(!js_ValueToBoolean(v)));
         return;
     }
 
@@ -677,7 +677,7 @@ mjit::Compiler::jsop_not()
           case JSVAL_TYPE_OBJECT:
           {
             frame.pop();
-            frame.push(BooleanTag(false));
+            frame.push(BooleanValue(false));
             break;
           }
 
@@ -781,7 +781,7 @@ mjit::Compiler::jsop_typeof()
 
         if (atom) {
             frame.pop();
-            frame.push(StringTag(ATOM_TO_STRING(atom)));
+            frame.push(StringValue(ATOM_TO_STRING(atom)));
             return;
         }
     }
@@ -916,7 +916,7 @@ mjit::Compiler::jsop_setelem()
 
     if ((obj->isTypeKnown() && obj->getKnownType() != JSVAL_TYPE_OBJECT) ||
         (id->isTypeKnown() && id->getKnownType() != JSVAL_TYPE_INT32) ||
-        (id->isConstant() && id->getValue().asInt32() < 0)) {
+        (id->isConstant() && id->getValue().toInt32() < 0)) {
         jsop_setelem_slow();
         return;
     }
@@ -949,11 +949,11 @@ mjit::Compiler::jsop_setelem()
     if (id->isConstant()) {
         Jump inRange = masm.branch32(Assembler::LessThanOrEqual,
                                      masm.payloadOf(Address(objReg, -int(sizeof(Value)))),
-                                     Imm32(id->getValue().asInt32()));
+                                     Imm32(id->getValue().toInt32()));
         stubcc.linkExit(inRange);
 
         /* guard not a hole */
-        Address slot(objReg, id->getValue().asInt32() * sizeof(Value));
+        Address slot(objReg, id->getValue().toInt32() * sizeof(Value));
         Jump notHole = masm.branch32(Assembler::Equal, masm.tagOf(slot), ImmTag(JSVAL_TAG_MAGIC));
         stubcc.linkExit(notHole);
 
@@ -1020,7 +1020,7 @@ mjit::Compiler::jsop_getelem()
 
     if ((obj->isTypeKnown() && obj->getKnownType() != JSVAL_TYPE_OBJECT) ||
         (id->isTypeKnown() && id->getKnownType() != JSVAL_TYPE_INT32) ||
-        (id->isConstant() && id->getValue().asInt32() < 0)) {
+        (id->isConstant() && id->getValue().toInt32() < 0)) {
         jsop_getelem_slow();
         return;
     }
@@ -1053,11 +1053,11 @@ mjit::Compiler::jsop_getelem()
     if (id->isConstant()) {
         Jump inRange = masm.branch32(Assembler::LessThanOrEqual,
                                      masm.payloadOf(Address(objReg, -int(sizeof(Value)))),
-                                     Imm32(id->getValue().asInt32()));
+                                     Imm32(id->getValue().toInt32()));
         stubcc.linkExit(inRange);
 
         /* guard not a hole */
-        Address slot(objReg, id->getValue().asInt32() * sizeof(Value));
+        Address slot(objReg, id->getValue().toInt32() * sizeof(Value));
         Jump notHole = masm.branch32(Assembler::Equal, masm.tagOf(slot), ImmTag(JSVAL_TAG_MAGIC));
         stubcc.linkExit(notHole);
 
@@ -1125,7 +1125,7 @@ mjit::Compiler::jsop_stricteq(JSOp op)
         if (test->isTypeKnown()) {
             FrameEntry *known = lhsTest ? lhs : rhs;
             frame.popn(2);
-            frame.push(BooleanTag((test->getKnownType() == known->getKnownType()) ==
+            frame.push(BooleanValue((test->getKnownType() == known->getKnownType()) ==
                                   (op == JSOP_STRICTEQ)));
             return;
         }
@@ -1150,7 +1150,7 @@ mjit::Compiler::jsop_stricteq(JSOp op)
 
         if (test->isTypeKnown() && test->getKnownType() != JSVAL_TYPE_BOOLEAN) {
             frame.popn(2);
-            frame.push(BooleanTag(op == JSOP_STRICTNE));
+            frame.push(BooleanValue(op == JSOP_STRICTNE));
             return;
         }
 
@@ -1158,7 +1158,7 @@ mjit::Compiler::jsop_stricteq(JSOp op)
             frame.popn(2);
             const Value &L = lhs->getValue();
             const Value &R = rhs->getValue();
-            frame.push(BooleanTag((L.asBoolean() == R.asBoolean()) == (op == JSOP_STRICTEQ)));
+            frame.push(BooleanValue((L.toBoolean() == R.toBoolean()) == (op == JSOP_STRICTEQ)));
             return;
         }
 
@@ -1170,7 +1170,7 @@ mjit::Compiler::jsop_stricteq(JSOp op)
            notBoolean = frame.testBoolean(Assembler::NotEqual, test);
 
         /* Do a dynamic test. */
-        bool val = lhsTest ? lhs->getValue().asBoolean() : rhs->getValue().asBoolean();
+        bool val = lhsTest ? lhs->getValue().toBoolean() : rhs->getValue().toBoolean();
         if (frame.shouldAvoidDataRemat(test))
             masm.set32(cond, masm.payloadOf(frame.addressOf(test)), Imm32(val), result);
         else