Merge and undo js_AllocateLoopTableSlot reparam.

js/src/jsemit.cpp

@@ -3906,7 +3906,7 @@ EmitLoopHeader(JSContext *cx, JSCodeGenerator *cg)
     if (off < 0)
         return JS_FALSE;
     pc = CG_CODE(cg, off);
-    uint32 slot = js_AllocateLoopTableSlot(cx);
+    uint32 slot = js_AllocateLoopTableSlot(cx->runtime);
     SET_UINT24(pc, slot);
     return JS_TRUE;
 }

js/src/jsscript.cpp

@@ -535,6 +535,17 @@ js_XDRScript(JSXDRState *xdr, JSScript **scriptp, JSBool *hasMagic)
     if (!ok)
         goto error;
 
+    jsbytecode *pc = code;
+    jsbytecode *end = pc + length;
+    while (pc < end) {
+        /* Assign a new loop table slot for every JSOP_HEADER opcode. */
+        if ((JSOp)*pc == JSOP_HEADER) {
+            uint32 slot = js_AllocateLoopTableSlot(cx->runtime);
+            SET_UINT24(pc, slot);
+        }
+        pc += js_OpLength(pc);
+    }
+    
     if (!JS_XDRBytes(xdr, (char *)notes, nsrcnotes * sizeof(jssrcnote)) ||
         !JS_XDRCStringOrNull(xdr, (char **)&script->filename) ||
         !JS_XDRUint32(xdr, &lineno) ||

js/src/jstracer.h

@@ -62,7 +62,7 @@ struct JSTraceMonitor {
 #define TRACE_THRESHOLD 10
 
 JSBool js_InitTracer(JSRuntime *rt);
-uint32 js_AllocateLoopTableSlot(JSContext *cx);
+uint32 js_AllocateLoopTableSlot(JSRuntime *rt);
 JSBool js_GrowLoopTable(JSContext *cx, uint32 index);
 
 #endif /* jstracer_h___ */