Merge.

js/src/jstracer.cpp

@@ -2003,7 +2003,7 @@ TraceRecorder::deduceTypeStability(Fragment* root_peer, Fragment** stable_peer,
         debug_only_v(printf("%s%d ", vpname, vpnum);)
         if (!checkType(*vp, *m, stage_vals[stage_count], stage_ins[stage_count], stage_count)) {
             /* If the failure was an int->double, tell the oracle. */
-            if (*m == JSVAL_INT && !isi2f(get(vp)))
+            if (*m == JSVAL_INT && isNumber(*vp) && !isPromoteInt(get(vp)))
                 oracle.markGlobalSlotUndemotable(cx->fp->script, gslots[n]);
             trashTree = true;
             goto checktype_fail_1;
@@ -2014,7 +2014,7 @@ TraceRecorder::deduceTypeStability(Fragment* root_peer, Fragment** stable_peer,
     FORALL_SLOTS_IN_PENDING_FRAMES(cx, 0,
         debug_only_v(printf("%s%d ", vpname, vpnum);)
         if (!checkType(*vp, *m, stage_vals[stage_count], stage_ins[stage_count], stage_count)) {
-            if (*m == JSVAL_INT && !isi2f(get(vp)))
+            if (*m == JSVAL_INT && isNumber(*vp) && !isPromoteInt(get(vp)))
                 ADD_DEMOTE_SLOT(demotes, unsigned(m - typemap));
             else
                 goto checktype_fail_1;

js/src/trace-test.js

@@ -2208,7 +2208,13 @@ function testTypeUnstableForIn() {
 testTypeUnstableForIn.expected = 16;
 test(testTypeUnstableForIn);
 
-/* Keep this test last, since it screws up all for...in loops after it */
+function testAddUndefined() {
+    for (var j = 0; j < 3; ++j)
+        (0 + void 0) && 0;
+}
+test(testAddUndefined);
+
+/* NOTE: Keep this test last, since it screws up all for...in loops after it. */
 function testGlobalProtoAccess() {
     return "ok";
 }
@@ -2216,12 +2222,6 @@ this.__proto__.a = 3; for (var j = 0; j < 4; ++j) { [a]; }
 testGlobalProtoAccess.expected = "ok";
 test(testGlobalProtoAccess);
 
-function testAddUndefined() {
-    for (var j = 0; j < 3; ++j)
-        (0 + void 0) && 0;
-}
-test(testAddUndefined);
-
 /* Keep these at the end so that we can see the summary after the trace-debug spew. */
 print("\npassed:", passes.length && passes.join(","));
 print("\nFAILED:", fails.length && fails.join(","));