Bug 522612 - TM: kill new skips-with-payloads. r=graydon.

js/src/jsrecursion.cpp

@@ -427,8 +427,8 @@ TraceRecorder::slurpDownFrames(jsbytecode* return_pc)
     unsigned numGlobalSlots = treeInfo->globalSlots->length();
     unsigned safeSlots = NativeStackSlots(cx, frameDepth) + 1 + numGlobalSlots;
     jsbytecode* recursive_pc = return_pc + JSOP_CALL_LENGTH;
-    LIns* data = lir->insSkip(sizeof(VMSideExit) + sizeof(JSTraceType) * safeSlots);
-    VMSideExit* exit = (VMSideExit*)data->payload();
+    VMSideExit* exit = (VMSideExit*)
+        traceMonitor->traceAlloc->alloc(sizeof(VMSideExit) + sizeof(JSTraceType) * safeSlots);
     memset(exit, 0, sizeof(VMSideExit));
     exit->pc = (jsbytecode*)recursive_pc;
     exit->from = fragment;

js/src/jstracer.cpp

@@ -783,10 +783,10 @@ void
 TraceRecorder::tprint(const char *format, int count, nanojit::LIns *insa[])
 {
     size_t size = strlen(format) + 1;
-    char *data = (char*) lir->insSkip(size)->payload();
+    char* data = (char*) traceMonitor->traceAlloc->alloc(size);
     memcpy(data, format, size);
 
-    double *args = (double*) lir->insSkip(count * sizeof(double))->payload();
+    double *args = (double*) traceMonitor->traceAlloc->alloc(count * sizeof(double));
     for (int i = 0; i < count; ++i) {
         JS_ASSERT(insa[i]);
         lir->insStorei(insa[i], INS_CONSTPTR(args), sizeof(double) * i);