[INFER] Don't use loop registers for entries after coercing them to double/any for a branch, bug 682563.

js/src/methodjit/Compiler.cpp

@@ -6918,6 +6918,7 @@ mjit::Compiler::fixDoubleTypes(jsbytecode *target)
                 if (vt.type == JSVAL_TYPE_INT32) {
                     fixedIntToDoubleEntries.append(newv->slot);
                     frame.ensureDouble(fe);
+                    frame.forgetLoopReg(fe);
                 } else if (vt.type == JSVAL_TYPE_UNKNOWN) {
                     /*
                      * Unknown here but a double at the target. The type
@@ -6932,6 +6933,7 @@ mjit::Compiler::fixDoubleTypes(jsbytecode *target)
             } else if (fe->isType(JSVAL_TYPE_DOUBLE)) {
                 fixedDoubleToAnyEntries.append(newv->slot);
                 frame.syncAndForgetFe(fe);
+                frame.forgetLoopReg(fe);
             }
             newv++;
         }

js/src/methodjit/FrameState-inl.h

@@ -878,6 +878,17 @@ FrameState::syncAndForgetFe(FrameEntry *fe, bool markSynced)
     fe->data.setMemory();
 }
 
+inline void
+FrameState::forgetLoopReg(FrameEntry *fe)
+{
+    /*
+     * Don't use a loop register for fe in the active loop, as its underlying
+     * representation may have changed since the start of the loop.
+     */
+    if (loop)
+        fe->lastLoop = loop->headOffset();
+}
+
 inline void
 FrameState::syncType(FrameEntry *fe)
 {

js/src/methodjit/FrameState.h

@@ -951,6 +951,7 @@ class FrameState
     Vector<TemporaryCopy> *getTemporaryCopies();
 
     inline void syncAndForgetFe(FrameEntry *fe, bool markSynced = false);
+    inline void forgetLoopReg(FrameEntry *fe);
 
   private:
     inline AnyRegisterID allocAndLoadReg(FrameEntry *fe, bool fp, RematInfo::RematType type);