Bug 562837 - TM: avoid reboxing when copying a double from one array to another. r=brendan.

js/src/jstracer.cpp

@@ -12286,13 +12286,17 @@ TraceRecorder::setElem(int lval_spindex, int idx_spindex, int v_spindex)
         // be an integer.
         idx_ins = makeNumberInt32(idx_ins);
 
-        // Box the value so we can use one builtin instead of having to add one
-        // builtin for every storage type. Special case for integers though,
-        // since they are so common.
+        // Box the value so we can use one builtin instead of having to add
+        // one builtin for every storage type. Special case for integers
+        // though, since they are so common;  but make sure we don't rebox
+        // unnecessarily.
         LIns* res_ins;
         LIns* args[] = { NULL, idx_ins, obj_ins, cx_ins };
         if (isNumber(v)) {
-            if (isPromoteInt(v_ins)) {
+            if (fcallinfo(v_ins) == &js_UnboxDouble_ci) {
+                args[0] = fcallarg(v_ins, 0);
+                res_ins = lir->insCall(&js_Array_dense_setelem_ci, args);
+            } else if (isPromoteInt(v_ins)) {
                 args[0] = demote(lir, v_ins);
                 res_ins = lir->insCall(&js_Array_dense_setelem_int_ci, args);
             } else {
@@ -12300,7 +12304,7 @@ TraceRecorder::setElem(int lval_spindex, int idx_spindex, int v_spindex)
                 res_ins = lir->insCall(&js_Array_dense_setelem_double_ci, args);
             }
         } else {
-            LIns* args[] = { box_jsval(v, v_ins), idx_ins, obj_ins, cx_ins };
+            args[0] = box_jsval(v, v_ins);
             res_ins = lir->insCall(&js_Array_dense_setelem_ci, args);
         }
         guard(false, lir->insEqI_0(res_ins), MISMATCH_EXIT);