--- a/configure.in
+++ b/configure.in
@@ -6596,24 +6596,16 @@ if test "$MOZ_MEMORY"; then
     dnl Also pass this to NSPR/NSS
     DLLFLAGS="$DLLFLAGS -MANIFEST:NO"
     export DLLFLAGS
     ;;
   *)
     AC_MSG_ERROR([--enable-jemalloc not supported on ${target}])
     ;;
   esac
-
-  AC_ARG_WITH([valgrind],
-    [  --with-valgrind         Enable valgrind integration hooks],
-    [enable_valgrind="yes"], [enable_valgrind="no"])
-  AC_CHECK_HEADER([valgrind/valgrind.h], [], [enable_valgrind="no"])
-  if test "x$enable_valgrind" = "xyes" ; then
-    AC_DEFINE(MOZ_VALGRIND)
-  fi
 fi
 AC_SUBST(MOZ_MEMORY)
 AC_SUBST(WIN32_CRT_SRC_DIR)
 AC_SUBST(WIN32_CUSTOM_CRT_DIR)
 AC_SUBST(MOZ_LIB)
 AC_SUBST(MOZ_PATH)
 dnl Need to set this for make because NSS doesn't have configure
 AC_SUBST(DLLFLAGS)
@@ -6636,16 +6628,30 @@ fi
 dnl ========================================================
 dnl = Location of malloc wrapper lib
 dnl ========================================================
 MOZ_ARG_WITH_STRING(wrap-malloc,
 [  --with-wrap-malloc=DIR  Location of malloc wrapper library],
     WRAP_MALLOC_LIB=$withval)
 
 dnl ========================================================
+dnl = Use Valgrind
+dnl ========================================================
+MOZ_ARG_ENABLE_BOOL(valgrind,
+[  --enable-valgrind       Enable Valgrind integration hooks (default=no)],
+    MOZ_VALGRIND=1,
+    MOZ_VALGRIND= )
+if test -n "$MOZ_VALGRIND"; then
+    AC_CHECK_HEADER([valgrind/valgrind.h], [],
+        AC_MSG_ERROR(
+            [--enable-valgrind specified but Valgrind is not installed]))
+    AC_DEFINE(MOZ_VALGRIND)
+fi
+
+dnl ========================================================
 dnl = Use Electric Fence
 dnl ========================================================
 MOZ_ARG_ENABLE_BOOL(efence,
 [  --enable-efence         Link with Electric Fence],
     _ENABLE_EFENCE=1,
     _ENABLE_EFENCE= )
 if test -n "$_ENABLE_EFENCE"; then
     AC_CHECK_LIB(efence,malloc)

--- a/dom/src/base/nsDOMClassInfo.cpp
+++ b/dom/src/base/nsDOMClassInfo.cpp
@@ -6364,17 +6364,17 @@ nsWindowSH::NewResolve(nsIXPConnectWrapp
       // readwrite "replaceable" property is being set w/o being
       // fully qualified. Define the property on obj with the value
       // undefined to override the predefined property. This is done
       // for compatibility with other browsers.
       JSAutoRequest ar(cx);
 
       if (!::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
                                  ::JS_GetStringLength(str),
-                                 JSVAL_VOID, nsnull, nsnull,
+                                 JSVAL_VOID, JS_PropertyStub, JS_PropertyStub,
                                  JSPROP_ENUMERATE)) {
         return NS_ERROR_FAILURE;
       }
       *objp = obj;
 
       return NS_OK;
     }
   } else {

--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -349,16 +349,24 @@ ifdef MOZ_SYNC_BUILD_FILES
 # js/config/autoconf.mk.in doesn't need most of the stuff in
 # config/autoconf.mk.in.
 check-sync-dirs = $(PYTHON) $(srcdir)/config/check-sync-dirs.py
 check::
 	$(check-sync-dirs) $(srcdir)/config $(MOZ_SYNC_BUILD_FILES)/config
 	$(check-sync-dirs) $(srcdir)/build $(MOZ_SYNC_BUILD_FILES)/build
 endif
 
+# Temporarily disable - backout of bug 473989.
+#ifdef ENABLE_JIT
+#check::
+#	$(wildcard $(RUN_TEST_PROGRAM)) ./js$(BIN_SUFFIX) -j -e \
+#		"var gSrcdir='$(srcdir)'; var gSkipSlowTests=true; var gReportSummary=false;" \
+#		$(srcdir)/trace-test.js
+#endif
+
 # our build system doesn't handle subdir srcs very gracefully today
 export::
 	mkdir -p nanojit
 
 DEFINES		+= -DEXPORT_JS_API 
 
 INCLUDES	+= -I$(srcdir)
 

--- a/js/src/builtins.tbl
+++ b/js/src/builtins.tbl
@@ -74,17 +74,16 @@ BUILTIN2(extern, DOUBLE,    js_dmod, DOU
 BUILTIN2(extern, INT32,     js_imod, INT32, INT32,                              1, 1)
 BUILTIN1(extern, INT32,     js_DoubleToInt32, DOUBLE,                           1, 1)
 BUILTIN1(extern, UINT32,    js_DoubleToUint32, DOUBLE,                          1, 1)
 
 BUILTIN2(extern, DOUBLE,    js_StringToNumber, CONTEXT, STRING,                 1, 1)
 BUILTIN2(extern, INT32,     js_StringToInt32, CONTEXT, STRING,                  1, 1)
 BUILTIN2(FRIEND, BOOL,      js_CloseIterator, CONTEXT, JSVAL,                   0, 0)
 BUILTIN2(extern, SIDEEXIT,  js_CallTree, INTERPSTATE, FRAGMENT,                 0, 0)
-BUILTIN2(extern, OBJECT,    js_FastNewObject, CONTEXT, OBJECT,                  0, 0)
 BUILTIN3(extern, BOOL,      js_AddProperty, CONTEXT, OBJECT, SCOPEPROP,         0, 0)
 BUILTIN3(extern, BOOL,      js_HasNamedProperty, CONTEXT, OBJECT, STRING,       0, 0)
 BUILTIN3(extern, BOOL,      js_HasNamedPropertyInt32, CONTEXT, OBJECT, INT32,   0, 0)
 BUILTIN3(extern, JSVAL,     js_CallGetter, CONTEXT, OBJECT, SCOPEPROP,          0, 0)
 BUILTIN2(extern, STRING,    js_TypeOfObject, CONTEXT, OBJECT,                   1, 1)
 BUILTIN2(extern, STRING,    js_TypeOfBoolean, CONTEXT, INT32,                   1, 1)
 BUILTIN2(extern, DOUBLE,    js_BooleanOrUndefinedToNumber, CONTEXT, INT32,      1, 1)
 BUILTIN2(extern, STRING,    js_BooleanOrUndefinedToString, CONTEXT, INT32,      1, 1)

--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -4267,24 +4267,16 @@ if test "$MOZ_MEMORY"; then
     dnl Also pass this to NSPR/NSS
     DLLFLAGS="$DLLFLAGS -MANIFEST:NO"
     export DLLFLAGS
     ;;
   *)
     AC_MSG_ERROR([--enable-jemalloc not supported on ${target}])
     ;;
   esac
-
-  AC_ARG_WITH([valgrind],
-    [  --with-valgrind         Enable valgrind integration hooks],
-    [enable_valgrind="yes"], [enable_valgrind="no"])
-  AC_CHECK_HEADER([valgrind/valgrind.h], [], [enable_valgrind="no"])
-  if test "x$enable_valgrind" = "xyes" ; then
-    AC_DEFINE(MOZ_VALGRIND)
-  fi
 fi
 AC_SUBST(MOZ_MEMORY)
 AC_SUBST(WIN32_CRT_SRC_DIR)
 AC_SUBST(WIN32_CUSTOM_CRT_DIR)
 AC_SUBST(MOZ_LIB)
 AC_SUBST(MOZ_PATH)
 dnl Need to set this for make because NSS doesn't have configure
 AC_SUBST(DLLFLAGS)
@@ -4307,16 +4299,30 @@ fi
 dnl ========================================================
 dnl = Location of malloc wrapper lib
 dnl ========================================================
 MOZ_ARG_WITH_STRING(wrap-malloc,
 [  --with-wrap-malloc=DIR  Location of malloc wrapper library],
     WRAP_MALLOC_LIB=$withval)
 
 dnl ========================================================
+dnl = Use Valgrind
+dnl ========================================================
+MOZ_ARG_ENABLE_BOOL(valgrind,
+[  --enable-valgrind       Enable Valgrind integration hooks (default=no)],
+    MOZ_VALGRIND=1,
+    MOZ_VALGRIND= )
+if test -n "$MOZ_VALGRIND"; then
+    AC_CHECK_HEADER([valgrind/valgrind.h], [],
+        AC_MSG_ERROR(
+            [--enable-valgrind specified but Valgrind is not installed]))
+    AC_DEFINE(MOZ_VALGRIND)
+fi
+
+dnl ========================================================
 dnl = Use Electric Fence
 dnl ========================================================
 MOZ_ARG_ENABLE_BOOL(efence,
 [  --enable-efence         Link with Electric Fence],
     _ENABLE_EFENCE=1,
     _ENABLE_EFENCE= )
 if test -n "$_ENABLE_EFENCE"; then
     AC_CHECK_LIB(efence,malloc)

--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -99,16 +99,24 @@
 
 #if defined(JS_THREADSAFE)
 #define CHECK_REQUEST(cx)                                                   \
     JS_ASSERT((cx)->requestDepth || (cx)->thread == (cx)->runtime->gcThread)
 #else
 #define CHECK_REQUEST(cx)       ((void)0)
 #endif
 
+/* Check that we can cast JSObject* as jsval without tag bit manipulations. */
+JS_STATIC_ASSERT(JSVAL_OBJECT == 0);
+
+/* Check that JSVAL_TRACE_KIND works. */
+JS_STATIC_ASSERT(JSVAL_TRACE_KIND(JSVAL_OBJECT) == JSTRACE_OBJECT);
+JS_STATIC_ASSERT(JSVAL_TRACE_KIND(JSVAL_DOUBLE) == JSTRACE_DOUBLE);
+JS_STATIC_ASSERT(JSVAL_TRACE_KIND(JSVAL_STRING) == JSTRACE_STRING);
+
 JS_PUBLIC_API(int64)
 JS_Now()
 {
     return PRMJ_Now();
 }
 
 JS_PUBLIC_API(jsval)
 JS_GetNaNValue(JSContext *cx)
@@ -2745,146 +2753,19 @@ JS_FinalizeStub(JSContext *cx, JSObject 
 }
 
 JS_PUBLIC_API(JSObject *)
 JS_InitClass(JSContext *cx, JSObject *obj, JSObject *parent_proto,
              JSClass *clasp, JSNative constructor, uintN nargs,
              JSPropertySpec *ps, JSFunctionSpec *fs,
              JSPropertySpec *static_ps, JSFunctionSpec *static_fs)
 {
-    JSAtom *atom;
-    JSProtoKey key;
-    JSObject *proto, *ctor;
-    JSTempValueRooter tvr;
-    jsval cval, rval;
-    JSBool named;
-    JSFunction *fun;
-
     CHECK_REQUEST(cx);
-    atom = js_Atomize(cx, clasp->name, strlen(clasp->name), 0);
-    if (!atom)
-        return NULL;
-
-    /*
-     * When initializing a standard class, if no parent_proto (grand-proto of
-     * instances of the class, parent-proto of the class's prototype object)
-     * is given, we must use Object.prototype if it is available.  Otherwise,
-     * we could look up the wrong binding for a class name in obj.  Example:
-     *
-     *   String = Array;
-     *   print("hi there".join);
-     *
-     * should print undefined, not Array.prototype.join.  This is required by
-     * ECMA-262, alas.  It might have been better to make String readonly and
-     * permanent in the global object, instead -- but that's too big a change
-     * to swallow at this point.
-     */
-    key = JSCLASS_CACHED_PROTO_KEY(clasp);
-    if (key != JSProto_Null &&
-        !parent_proto &&
-        !js_GetClassPrototype(cx, obj, INT_TO_JSID(JSProto_Object),
-                              &parent_proto)) {
-        return NULL;
-    }
-
-    /* Create a prototype object for this class. */
-    proto = js_NewObject(cx, clasp, parent_proto, obj, 0);
-    if (!proto)
-        return NULL;
-
-    /* After this point, control must exit via label bad or out. */
-    JS_PUSH_TEMP_ROOT_OBJECT(cx, proto, &tvr);
-
-    if (!constructor) {
-        /*
-         * Lacking a constructor, name the prototype (e.g., Math) unless this
-         * class (a) is anonymous, i.e. for internal use only; (b) the class
-         * of obj (the global object) is has a reserved slot indexed by key;
-         * and (c) key is not the null key.
-         */
-        if ((clasp->flags & JSCLASS_IS_ANONYMOUS) &&
-            (OBJ_GET_CLASS(cx, obj)->flags & JSCLASS_IS_GLOBAL) &&
-            key != JSProto_Null) {
-            named = JS_FALSE;
-        } else {
-            named = OBJ_DEFINE_PROPERTY(cx, obj, ATOM_TO_JSID(atom),
-                                        OBJECT_TO_JSVAL(proto),
-                                        JS_PropertyStub, JS_PropertyStub,
-                                        (clasp->flags & JSCLASS_IS_ANONYMOUS)
-                                        ? JSPROP_READONLY | JSPROP_PERMANENT
-                                        : 0,
-                                        NULL);
-            if (!named)
-                goto bad;
-        }
-
-        ctor = proto;
-    } else {
-        /* Define the constructor function in obj's scope. */
-        fun = js_DefineFunction(cx, obj, atom, constructor, nargs,
-                                JSFUN_STUB_GSOPS);
-        named = (fun != NULL);
-        if (!fun)
-            goto bad;
-
-        /*
-         * Remember the class this function is a constructor for so that
-         * we know to create an object of this class when we call the
-         * constructor.
-         */
-        FUN_CLASP(fun) = clasp;
-
-        /*
-         * Optionally construct the prototype object, before the class has
-         * been fully initialized.  Allow the ctor to replace proto with a
-         * different object, as is done for operator new -- and as at least
-         * XML support requires.
-         */
-        ctor = FUN_OBJECT(fun);
-        if (clasp->flags & JSCLASS_CONSTRUCT_PROTOTYPE) {
-            cval = OBJECT_TO_JSVAL(ctor);
-            if (!js_InternalConstruct(cx, proto, cval, 0, NULL, &rval))
-                goto bad;
-            if (!JSVAL_IS_PRIMITIVE(rval) && JSVAL_TO_OBJECT(rval) != proto)
-                proto = JSVAL_TO_OBJECT(rval);
-        }
-
-        /* Connect constructor and prototype by named properties. */
-        if (!js_SetClassPrototype(cx, ctor, proto,
-                                  JSPROP_READONLY | JSPROP_PERMANENT)) {
-            goto bad;
-        }
-
-        /* Bootstrap Function.prototype (see also JS_InitStandardClasses). */
-        if (OBJ_GET_CLASS(cx, ctor) == clasp) {
-            OBJ_SET_PROTO(cx, ctor, proto);
-        }
-    }
-
-    /* Add properties and methods to the prototype and the constructor. */
-    if ((ps && !JS_DefineProperties(cx, proto, ps)) ||
-        (fs && !JS_DefineFunctions(cx, proto, fs)) ||
-        (static_ps && !JS_DefineProperties(cx, ctor, static_ps)) ||
-        (static_fs && !JS_DefineFunctions(cx, ctor, static_fs))) {
-        goto bad;
-    }
-
-    /* If this is a standard class, cache its prototype. */
-    if (key != JSProto_Null && !js_SetClassObject(cx, obj, key, ctor))
-        goto bad;
-
-out:
-    JS_POP_TEMP_ROOT(cx, &tvr);
-    return proto;
-
-bad:
-    if (named)
-        (void) OBJ_DELETE_PROPERTY(cx, obj, ATOM_TO_JSID(atom), &rval);
-    proto = NULL;
-    goto out;
+    return js_InitClass(cx, obj, parent_proto, clasp, constructor, nargs,
+                        ps, fs, static_ps, static_fs, NULL);
 }
 
 #ifdef JS_THREADSAFE
 JS_PUBLIC_API(JSClass *)
 JS_GetClass(JSContext *cx, JSObject *obj)
 {
     return OBJ_GET_CLASS(cx, obj);
 }

--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -110,17 +110,16 @@ JSVAL_TO_STRING(jsval v)
 {
     JS_ASSERT(JSVAL_IS_STRING(v));
     return (JSString *) JSVAL_TO_GCTHING(v);
 }
 
 static JS_ALWAYS_INLINE jsval
 OBJECT_TO_JSVAL(JSObject *obj)
 {
-    JS_STATIC_ASSERT(JSVAL_OBJECT == 0);
     JS_ASSERT(((jsval) obj & JSVAL_TAGMASK) == JSVAL_OBJECT);
     return (jsval) obj;
 }
 
 static JS_ALWAYS_INLINE jsval
 DOUBLE_TO_JSVAL(jsdouble *dp)
 {
     JS_ASSERT(((jsword) dp & JSVAL_TAGMASK) == 0);
@@ -1011,20 +1010,16 @@ JS_MarkGCThing(JSContext *cx, void *thin
 /*
  * Use the following macros to check if a particular jsval is a traceable
  * thing and to extract the thing and its kind to pass to JS_CallTracer.
  */
 #define JSVAL_IS_TRACEABLE(v)   (JSVAL_IS_GCTHING(v) && !JSVAL_IS_NULL(v))
 #define JSVAL_TO_TRACEABLE(v)   (JSVAL_TO_GCTHING(v))
 #define JSVAL_TRACE_KIND(v)     (JSVAL_TAG(v) >> 1)
 
-JS_STATIC_ASSERT(JSVAL_TRACE_KIND(JSVAL_OBJECT) == JSTRACE_OBJECT);
-JS_STATIC_ASSERT(JSVAL_TRACE_KIND(JSVAL_DOUBLE) == JSTRACE_DOUBLE);
-JS_STATIC_ASSERT(JSVAL_TRACE_KIND(JSVAL_STRING) == JSTRACE_STRING);
-
 struct JSTracer {
     JSContext           *context;
     JSTraceCallback     callback;
 #ifdef DEBUG
     JSTraceNamePrinter  debugPrinter;
     const void          *debugPrintArg;
     size_t              debugPrintIndex;
 #endif

--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -36,17 +36,17 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 /*
  * JS array class.
  *
- * Array objects begin as "dense" arrays, optimized for numeric-only property
+ * Array objects begin as "dense" arrays, optimized for index-only property
  * access over a vector of slots (obj->dslots) with high load factor.  Array
  * methods optimize for denseness by testing that the object's class is
  * &js_ArrayClass, and can then directly manipulate the slots for efficiency.
  *
  * We track these pieces of metadata for arrays in dense mode:
  *  - the array's length property as a uint32, in JSSLOT_ARRAY_LENGTH,
  *  - the number of indices that are filled (non-holes), in JSSLOT_ARRAY_COUNT,
  *  - the net number of slots starting at dslots (capacity), in dslots[-1] if
@@ -55,17 +55,17 @@
  * In dense mode, holes in the array are represented by JSVAL_HOLE.  The final
  * slot in fslots (JSSLOT_ARRAY_LOOKUP_HOLDER) is used to store the single jsid
  * "in use" by a lookupProperty caller.
  *
  * Arrays are converted to use js_SlowArrayClass when any of these conditions
  * are met:
  *  - the load factor (COUNT / capacity) is less than 0.25, and there are
  *    more than MIN_SPARSE_INDEX slots total
- *  - a property is set that is non-numeric (and not "length"); or
+ *  - a property is set that is not indexed (and not "length"); or
  *  - a property is defined that has non-default property attributes.
  *
  * Dense arrays do not track property creation order, so unlike other native
  * objects and slow arrays, enumerating an array does not necessarily visit the
  * properties in the order they were created.  We could instead maintain the
  * scope to track property enumeration order, but still use the fast slot
  * access.  That would have the same memory cost as just using a
  * js_SlowArrayClass, but have the same performance characteristics as a dense
@@ -817,16 +817,38 @@ array_setProperty(JSContext *cx, JSObjec
     if (i >= (uint32)obj->fslots[JSSLOT_ARRAY_LENGTH])
         obj->fslots[JSSLOT_ARRAY_LENGTH] = i + 1;
     if (obj->dslots[i] == JSVAL_HOLE)
         obj->fslots[JSSLOT_ARRAY_COUNT]++;
     obj->dslots[i] = *vp;
     return JS_TRUE;
 }
 
+JSBool
+js_PrototypeHasIndexedProperties(JSContext *cx, JSObject *obj)
+{
+    /*
+     * Walk up the prototype chain and see if this indexed element already
+     * exists. If we hit the end of the prototype chain, it's safe to set the
+     * element on the original object.
+     */
+   while ((obj = JSVAL_TO_OBJECT(obj->fslots[JSSLOT_PROTO])) != NULL) {
+        /*
+         * If the prototype is a non-native object (possibly a dense array), or
+         * a native object (possibly a slow array) that has indexed properties,
+         * return true.
+         */
+        if (!OBJ_IS_NATIVE(obj))
+            return JS_TRUE;
+        if (SCOPE_HAS_INDEXED_PROPERTIES(OBJ_SCOPE(obj)))
+            return JS_TRUE;
+    }
+    return JS_FALSE;
+}
+
 #ifdef JS_TRACER
 JSBool FASTCALL
 js_Array_dense_setelem(JSContext* cx, JSObject* obj, jsint i, jsval v)
 {
     JS_ASSERT(OBJ_IS_DENSE_ARRAY(cx, obj));
 
     /*
      * Let the interpreter worry about negative array indexes.
@@ -838,18 +860,19 @@ js_Array_dense_setelem(JSContext* cx, JS
      * If needed, grow the array as long it remains dense, otherwise fall off trace.
      */
     jsuint u = jsuint(i);
     jsuint capacity = js_DenseArrayCapacity(obj);
     if ((u >= capacity) && (INDEX_TOO_SPARSE(obj, u) || !EnsureCapacity(cx, obj, u + 1)))
         return JS_FALSE;
 
     if (obj->dslots[u] == JSVAL_HOLE) {
-        if (cx->runtime->anyArrayProtoHasElement)
+        if (js_PrototypeHasIndexedProperties(cx, obj))
             return JS_FALSE;
+
         if (u >= jsuint(obj->fslots[JSSLOT_ARRAY_LENGTH]))
             obj->fslots[JSSLOT_ARRAY_LENGTH] = u + 1;
         ++obj->fslots[JSSLOT_ARRAY_COUNT];
     }
 
     obj->dslots[u] = v;
     return JS_TRUE;
 }

--- a/js/src/jsarray.h
+++ b/js/src/jsarray.h
@@ -58,16 +58,38 @@ js_IdIsIndex(jsval id, jsuint *indexp);
 
 extern JSClass js_ArrayClass, js_SlowArrayClass;
 
 #define OBJ_IS_DENSE_ARRAY(cx,obj)  (OBJ_GET_CLASS(cx, obj) == &js_ArrayClass)
 
 #define OBJ_IS_ARRAY(cx,obj)    (OBJ_IS_DENSE_ARRAY(cx, obj) ||               \
                                  OBJ_GET_CLASS(cx, obj) == &js_SlowArrayClass)
 
+/*
+ * Dense arrays are not native (OBJ_IS_NATIVE(cx, aobj) for a dense array aobj
+ * results in false, meaning aobj->map does not point to a JSScope).
+ *
+ * But Array methods are called via aobj.sort(), e.g., and the interpreter and
+ * the trace recorder must consult the property cache in order to perform well.
+ * The cache works only for native objects.
+ *
+ * Therefore the interpreter (js_Interpret in JSOP_GETPROP and JSOP_CALLPROP)
+ * and js_GetPropertyHelper use this inline function to skip up one link in the
+ * prototype chain when obj is a dense array, in order to find a likely-native
+ * object (to wit, Array.prototype) in which to probe for cached methods.
+ *
+ * Callers of js_GetProtoIfDenseArray must take care to use the original object
+ * (obj) for the |this| value of a getter, setter, or method call (bug 476447).
+ */
+static JS_INLINE JSObject *
+js_GetProtoIfDenseArray(JSContext *cx, JSObject *obj)
+{
+    return OBJ_IS_DENSE_ARRAY(cx, obj) ? OBJ_GET_PROTO(cx, obj) : obj;
+}
+
 extern JSObject *
 js_InitArrayClass(JSContext *cx, JSObject *obj);
 
 extern JSObject *
 js_NewArrayObject(JSContext *cx, jsuint length, jsval *vector,
                   JSBool holey = JS_FALSE);
 
 /* Create an array object that starts out already made slow/sparse. */
@@ -193,11 +215,14 @@ js_ArrayToJSInt16Buffer(JSContext *cx, J
 JS_FRIEND_API(JSBool)
 js_ArrayToJSInt32Buffer(JSContext *cx, JSObject *obj, jsuint offset, jsuint count,
                         JSInt32 *dest);
 
 JS_FRIEND_API(JSBool)
 js_ArrayToJSDoubleBuffer(JSContext *cx, JSObject *obj, jsuint offset, jsuint count,
                          jsdouble *dest);
 
+JSBool
+js_PrototypeHasIndexedProperties(JSContext *cx, JSObject *obj);
+
 JS_END_EXTERN_C
 
 #endif /* jsarray_h___ */

--- a/js/src/jsatom.cpp
+++ b/js/src/jsatom.cpp
@@ -51,16 +51,38 @@
 #include "jscntxt.h"
 #include "jsversion.h"
 #include "jsgc.h"
 #include "jslock.h"
 #include "jsnum.h"
 #include "jsscan.h"
 #include "jsstr.h"
 
+/*
+ * ATOM_HASH assumes that JSHashNumber is 32-bit even on 64-bit systems.
+ */
+JS_STATIC_ASSERT(sizeof(JSHashNumber) == 4);
+JS_STATIC_ASSERT(sizeof(JSAtom *) == JS_BYTES_PER_WORD);
+
+/*
+ * Start and limit offsets for atom pointers in JSAtomState must be aligned
+ * on the word boundary.
+ */
+JS_STATIC_ASSERT(ATOM_OFFSET_START % sizeof(JSAtom *) == 0);
+JS_STATIC_ASSERT(ATOM_OFFSET_LIMIT % sizeof(JSAtom *) == 0);
+
+/*
+ * JS_BOOLEAN_STR and JS_TYPE_STR assume that boolean names starts from the
+ * index 1 and type name starts from the index 1+2 atoms in JSAtomState.
+ */
+JS_STATIC_ASSERT(1 * sizeof(JSAtom *) ==
+                 offsetof(JSAtomState, booleanAtoms) - ATOM_OFFSET_START);
+JS_STATIC_ASSERT((1 + 2) * sizeof(JSAtom *) ==
+                 offsetof(JSAtomState, typeAtoms) - ATOM_OFFSET_START);
+
 const char *
 js_AtomToPrintableString(JSContext *cx, JSAtom *atom)
 {
     return js_ValueToPrintableString(cx, ATOM_KEY(atom));
 }
 
 #define JS_PROTO(name,code,init) const char js_##name##_str[] = #name;
 #include "jsproto.tbl"

--- a/js/src/jsatom.h
+++ b/js/src/jsatom.h
@@ -60,19 +60,16 @@ JS_BEGIN_EXTERN_C
 #define ATOM_TMPSTR     0x8       /* internal, to avoid extra string */
 
 #define ATOM_KEY(atom)            ((jsval)(atom))
 #define ATOM_IS_DOUBLE(atom)      JSVAL_IS_DOUBLE(ATOM_KEY(atom))
 #define ATOM_TO_DOUBLE(atom)      JSVAL_TO_DOUBLE(ATOM_KEY(atom))
 #define ATOM_IS_STRING(atom)      JSVAL_IS_STRING(ATOM_KEY(atom))
 #define ATOM_TO_STRING(atom)      JSVAL_TO_STRING(ATOM_KEY(atom))
 
-JS_STATIC_ASSERT(sizeof(JSHashNumber) == 4);
-JS_STATIC_ASSERT(sizeof(JSAtom *) == JS_BYTES_PER_WORD);
-
 #if JS_BYTES_PER_WORD == 4
 # define ATOM_HASH(atom)          ((JSHashNumber)(atom) >> 2)
 #elif JS_BYTES_PER_WORD == 8
 # define ATOM_HASH(atom)          (((JSHashNumber)(jsuword)(atom) >> 3) ^     \
                                    (JSHashNumber)((jsuword)(atom) >> 32))
 #else
 # error "Unsupported configuration"
 #endif
@@ -269,42 +266,32 @@ struct JSAtomState {
     ((JSAtom **)((uint8 *)(state) + ATOM_OFFSET_START))
 #define COMMON_ATOM_INDEX(name)                                               \
     ((offsetof(JSAtomState, name##Atom) - ATOM_OFFSET_START)                  \
      / sizeof(JSAtom*))
 #define COMMON_TYPE_ATOM_INDEX(type)                                          \
     ((offsetof(JSAtomState, typeAtoms[type]) - ATOM_OFFSET_START)             \
      / sizeof(JSAtom*))
 
-/* Start and limit offsets should correspond to atoms. */
-JS_STATIC_ASSERT(ATOM_OFFSET_START % sizeof(JSAtom *) == 0);
-JS_STATIC_ASSERT(ATOM_OFFSET_LIMIT % sizeof(JSAtom *) == 0);
-
 #define ATOM_OFFSET(name)       offsetof(JSAtomState, name##Atom)
 #define OFFSET_TO_ATOM(rt,off)  (*(JSAtom **)((char*)&(rt)->atomState + (off)))
 #define CLASS_ATOM_OFFSET(name) offsetof(JSAtomState,classAtoms[JSProto_##name])
 
 #define CLASS_ATOM(cx,name) \
     ((cx)->runtime->atomState.classAtoms[JSProto_##name])
 
 extern const char *const js_common_atom_names[];
 extern const size_t      js_common_atom_count;
 
 /*
- * Macros to access C strings for JSType and boolean literals together with
- * checks that boolean names start from index 1 and type names from 1+2.
+ * Macros to access C strings for JSType and boolean literals.
  */
 #define JS_BOOLEAN_STR(type) (js_common_atom_names[1 + (type)])
 #define JS_TYPE_STR(type)    (js_common_atom_names[1 + 2 + (type)])
 
-JS_STATIC_ASSERT(1 * sizeof(JSAtom *) ==
-                 offsetof(JSAtomState, booleanAtoms) - ATOM_OFFSET_START);
-JS_STATIC_ASSERT((1 + 2) * sizeof(JSAtom *) ==
-                 offsetof(JSAtomState, typeAtoms) - ATOM_OFFSET_START);
-
 /* Well-known predefined C strings. */
 #define JS_PROTO(name,code,init) extern const char js_##name##_str[];
 #include "jsproto.tbl"
 #undef JS_PROTO
 
 extern const char   js_anonymous_str[];
 extern const char   js_apply_str[];
 extern const char   js_arguments_str[];

--- a/js/src/jsbit.h
+++ b/js/src/jsbit.h
@@ -124,17 +124,16 @@ unsigned char _BitScanReverse(unsigned l
 #ifdef JS_HAS_BUILTIN_BITSCAN32
 /*
  * Use intrinsic function or count-leading-zeros to calculate ceil(log2(_n)).
  * The macro checks for "n <= 1" and not "n != 0" as js_bitscan_clz32(0) is
  * undefined.
  */
 # define JS_CEILING_LOG2(_log2,_n)                                            \
     JS_BEGIN_MACRO                                                            \
-        JS_STATIC_ASSERT(sizeof(unsigned int) == sizeof(JSUint32));           \
         unsigned int j_ = (unsigned int)(_n);                                 \
         (_log2) = (j_ <= 1 ? 0 : 32 - js_bitscan_clz32(j_ - 1));              \
     JS_END_MACRO
 #else
 # define JS_CEILING_LOG2(_log2,_n)                                            \
     JS_BEGIN_MACRO                                                            \
         JSUint32 j_ = (JSUint32)(_n);                                         \
         (_log2) = 0;                                                          \
@@ -162,17 +161,16 @@ unsigned char _BitScanReverse(unsigned l
 #ifdef JS_HAS_BUILTIN_BITSCAN32
 /*
  * Use js_bitscan_clz32 or count-leading-zeros to calculate floor(log2(_n)).
  * Since js_bitscan_clz32(0) is undefined, the macro set the loweset bit to 1
  * to ensure 0 result when _n == 0.
  */
 # define JS_FLOOR_LOG2(_log2,_n)                                              \
     JS_BEGIN_MACRO                                                            \
-        JS_STATIC_ASSERT(sizeof(unsigned int) == sizeof(JSUint32));           \
         (_log2) = 31 - js_bitscan_clz32(((unsigned int)(_n)) | 1);            \
     JS_END_MACRO
 #else
 # define JS_FLOOR_LOG2(_log2,_n)                                              \
     JS_BEGIN_MACRO                                                            \
         JSUint32 j_ = (JSUint32)(_n);                                         \
         (_log2) = 0;                                                          \
         if ((j_) >> 16)                                                       \
@@ -202,27 +200,25 @@ unsigned char _BitScanReverse(unsigned l
  * This is a version of JS_FloorLog2 that operates on jsuword with
  * CPU-dependant size and requires that n != 0.
  */
 #define JS_FLOOR_LOG2W(n) (JS_ASSERT((n) != 0), js_FloorLog2wImpl(n))
 
 #if JS_BYTES_PER_WORD == 4
 
 # ifdef JS_HAS_BUILTIN_BITSCAN32
-JS_STATIC_ASSERT(sizeof(unsigned) == sizeof(JSUword));
 #  define js_FloorLog2wImpl(n)                                                \
     ((JSUword)(JS_BITS_PER_WORD - 1 - js_bitscan_clz32(n)))
 # else
 #  define js_FloorLog2wImpl(n) ((JSUword)JS_FloorLog2(n))
 #endif
 
 #elif JS_BYTES_PER_WORD == 8
 
 # ifdef JS_HAS_BUILTIN_BITSCAN64
-JS_STATIC_ASSERT(sizeof(unsigned long long) == sizeof(JSUword));
 #  define js_FloorLog2wImpl(n)                                                \
     ((JSUword)(JS_BITS_PER_WORD - 1 - js_bitscan_clz64(n)))
 # else
 extern JSUword js_FloorLog2wImpl(JSUword n);
 # endif
 
 #else
 

--- a/js/src/jsbuiltins.cpp
+++ b/js/src/jsbuiltins.cpp
@@ -216,62 +216,16 @@ js_CallTree(InterpState* state, Fragment
            with that guard. If we mismatch on a tree call guard, this will contain the last
            non-nested guard we encountered, which is the innermost loop or branch guard. */
         state->lastTreeExitGuard = lr;
     }
 
     return lr;
 }
 
-JSObject* FASTCALL
-js_FastNewObject(JSContext* cx, JSObject* ctor)
-{
-    JS_ASSERT(HAS_FUNCTION_CLASS(ctor));
-    JSFunction* fun = GET_FUNCTION_PRIVATE(cx, ctor);
-    JSClass* clasp = (FUN_INTERPRETED(fun) || (fun->flags & JSFUN_TRACEABLE))
-                     ? &js_ObjectClass
-                     : FUN_CLASP(fun);
-    JS_ASSERT(clasp != &js_ArrayClass);
-
-    JS_LOCK_OBJ(cx, ctor);
-    JSScope *scope = OBJ_SCOPE(ctor);
-    JS_ASSERT(scope->object == ctor);
-    JSAtom* atom = cx->runtime->atomState.classPrototypeAtom;
-
-    JSScopeProperty *sprop = SCOPE_GET_PROPERTY(scope, ATOM_TO_JSID(atom));
-    JS_ASSERT(SPROP_HAS_VALID_SLOT(sprop, scope));
-    jsval v = LOCKED_OBJ_GET_SLOT(ctor, sprop->slot);
-    JS_UNLOCK_SCOPE(cx, scope);
-
-    JSObject* proto;
-    if (JSVAL_IS_PRIMITIVE(v)) {
-        if (!js_GetClassPrototype(cx, JSVAL_TO_OBJECT(ctor->fslots[JSSLOT_PARENT]), 
-                                  INT_TO_JSID(JSProto_Object), &proto)) {
-            return NULL;
-        }
-    } else {
-        proto = JSVAL_TO_OBJECT(v);
-    }
-
-    JS_ASSERT(JS_ON_TRACE(cx));
-    JSObject* obj = (JSObject*) js_NewGCThing(cx, GCX_OBJECT, sizeof(JSObject));
-    if (!obj)
-        return NULL;
-
-    obj->classword = jsuword(clasp);
-    obj->fslots[JSSLOT_PROTO] = OBJECT_TO_JSVAL(proto);
-    obj->fslots[JSSLOT_PARENT] = ctor->fslots[JSSLOT_PARENT];
-    for (unsigned i = JSSLOT_PRIVATE; i != JS_INITIAL_NSLOTS; ++i)
-        obj->fslots[i] = JSVAL_VOID;
-
-    obj->map = js_HoldObjectMap(cx, proto->map);
-    obj->dslots = NULL;
-    return obj;
-}
-
 JSBool FASTCALL
 js_AddProperty(JSContext* cx, JSObject* obj, JSScopeProperty* sprop)
 {
     JSScopeProperty* sprop2 = NULL; // initialize early to make MSVC happy
 
     JS_ASSERT(OBJ_IS_NATIVE(obj));
     JS_ASSERT(SPROP_HAS_STUB_SETTER(sprop));
 

--- a/js/src/jsbuiltins.h
+++ b/js/src/jsbuiltins.h
@@ -45,17 +45,18 @@
 #include "nanojit/nanojit.h"
 #include "jstracer.h"
 
 #ifdef THIS
 #undef THIS
 #endif
 
 enum JSTNErrType { INFALLIBLE, FAIL_STATUS, FAIL_NULL, FAIL_NEG, FAIL_VOID, FAIL_COOKIE };
-enum { JSTN_ERRTYPE_MASK = 0x07, JSTN_UNBOX_AFTER = 0x08, JSTN_MORE = 0x10 };
+enum { JSTN_ERRTYPE_MASK = 0x07, JSTN_UNBOX_AFTER = 0x08, JSTN_MORE = 0x10,
+       JSTN_CONSTRUCTOR = 0x20 };
 
 #define JSTN_ERRTYPE(jstn)  ((jstn)->flags & JSTN_ERRTYPE_MASK)
 
 /*
  * |prefix| and |argtypes| declare what arguments should be passed to the
  * native function.  |prefix| can contain the following characters:
  *
  * 'C': a JSContext* argument
@@ -80,17 +81,18 @@ enum { JSTN_ERRTYPE_MASK = 0x07, JSTN_UN
  * 'f': a JSObject* argument that is of class js_FunctionClass
  * 'v': a jsval argument (boxing whatever value is actually being passed in)
  */
 struct JSTraceableNative {
     JSFastNative            native;
     const nanojit::CallInfo *builtin;
     const char              *prefix;
     const char              *argtypes;
-    uintN                   flags;  /* JSTNErrType | JSTN_UNBOX_AFTER | JSTN_MORE */
+    uintN                   flags;  /* JSTNErrType | JSTN_UNBOX_AFTER | JSTN_MORE | 
+                                       JSTN_CONSTRUCTOR */
 };
 
 /*
  * We use a magic boxed pointer value to represent error conditions that
  * trigger a side exit. The address is so low that it should never be actually
  * in use. If it is, a performance regression occurs, not an actual runtime
  * error.
  */
@@ -172,33 +174,37 @@ struct JSTraceableNative {
 #define _JS_CTYPE(ctype, size, pch, ach, flags)     (ctype, size, pch, ach, flags)
 #define _JS_JSVAL_CTYPE(size, pch, ach, flags)  (jsval, size, pch, ach, (flags | JSTN_UNBOX_AFTER))
 
 #define _JS_CTYPE_CONTEXT           _JS_CTYPE(JSContext *,            _JS_PTR,"C", "", INFALLIBLE)
 #define _JS_CTYPE_RUNTIME           _JS_CTYPE(JSRuntime *,            _JS_PTR,"R", "", INFALLIBLE)
 #define _JS_CTYPE_THIS              _JS_CTYPE(JSObject *,             _JS_PTR,"T", "", INFALLIBLE)
 #define _JS_CTYPE_THIS_DOUBLE       _JS_CTYPE(jsdouble,               _JS_F64,"D", "", INFALLIBLE)
 #define _JS_CTYPE_THIS_STRING       _JS_CTYPE(JSString *,             _JS_PTR,"S", "", INFALLIBLE)
+#define _JS_CTYPE_CALLEE            _JS_CTYPE(JSObject *,             _JS_PTR,"f","",  INFALLIBLE)
+#define _JS_CTYPE_CALLEE_PROTOTYPE  _JS_CTYPE(JSObject *,             _JS_PTR,"p","",  INFALLIBLE)
 #define _JS_CTYPE_PC                _JS_CTYPE(jsbytecode *,           _JS_PTR,"P", "", INFALLIBLE)
 #define _JS_CTYPE_JSVAL             _JS_JSVAL_CTYPE(                  _JS_PTR, "","v", INFALLIBLE)
 #define _JS_CTYPE_JSVAL_RETRY       _JS_JSVAL_CTYPE(                  _JS_PTR, --, --, FAIL_COOKIE)
 #define _JS_CTYPE_JSVAL_FAIL        _JS_JSVAL_CTYPE(                  _JS_PTR, --, --, FAIL_STATUS)
 #define _JS_CTYPE_BOOL              _JS_CTYPE(JSBool,                 _JS_I32, "","i", INFALLIBLE)
 #define _JS_CTYPE_BOOL_RETRY        _JS_CTYPE(int32,                  _JS_I32, --, --, FAIL_VOID)
 #define _JS_CTYPE_BOOL_FAIL         _JS_CTYPE(int32,                  _JS_I32, --, --, FAIL_STATUS)
 #define _JS_CTYPE_INT32             _JS_CTYPE(int32,                  _JS_I32, "","i", INFALLIBLE)
 #define _JS_CTYPE_INT32_RETRY       _JS_CTYPE(int32,                  _JS_I32, --, --, FAIL_NEG)
 #define _JS_CTYPE_UINT32            _JS_CTYPE(uint32,                 _JS_I32, --, --, INFALLIBLE)
 #define _JS_CTYPE_DOUBLE            _JS_CTYPE(jsdouble,               _JS_F64, "","d", INFALLIBLE)
 #define _JS_CTYPE_STRING            _JS_CTYPE(JSString *,             _JS_PTR, "","s", INFALLIBLE)
 #define _JS_CTYPE_STRING_RETRY      _JS_CTYPE(JSString *,             _JS_PTR, --, --, FAIL_NULL)
 #define _JS_CTYPE_STRING_FAIL       _JS_CTYPE(JSString *,             _JS_PTR, --, --, FAIL_STATUS)
 #define _JS_CTYPE_OBJECT            _JS_CTYPE(JSObject *,             _JS_PTR, "","o", INFALLIBLE)
-#define _JS_CTYPE_OBJECT_RETRY_NULL _JS_CTYPE(JSObject *,             _JS_PTR, --, --, FAIL_NULL)
+#define _JS_CTYPE_OBJECT_RETRY      _JS_CTYPE(JSObject *,             _JS_PTR, --, --, FAIL_NULL)
 #define _JS_CTYPE_OBJECT_FAIL       _JS_CTYPE(JSObject *,             _JS_PTR, --, --, FAIL_STATUS)
+#define _JS_CTYPE_CONSTRUCTOR_RETRY _JS_CTYPE(JSObject *,             _JS_PTR, --, --, FAIL_NULL | \
+                                                                                  JSTN_CONSTRUCTOR)
 #define _JS_CTYPE_REGEXP            _JS_CTYPE(JSObject *,             _JS_PTR, "","r", INFALLIBLE)
 #define _JS_CTYPE_SCOPEPROP         _JS_CTYPE(JSScopeProperty *,      _JS_PTR, --, --, INFALLIBLE)
 #define _JS_CTYPE_SIDEEXIT          _JS_CTYPE(SideExit *,             _JS_PTR, --, --, INFALLIBLE)
 #define _JS_CTYPE_INTERPSTATE       _JS_CTYPE(InterpState *,          _JS_PTR, --, --, INFALLIBLE)
 #define _JS_CTYPE_FRAGMENT          _JS_CTYPE(nanojit::Fragment *,    _JS_PTR, --, --, INFALLIBLE)
 
 #define _JS_EXPAND(tokens)  tokens
 
@@ -310,47 +316,47 @@ struct JSTraceableNative {
         _JS_CTYPE_PCH(at0),                                                                       \
     _JS_CTYPE_ACH(at4) _JS_CTYPE_ACH(at3) _JS_CTYPE_ACH(at2) _JS_CTYPE_ACH(at1)                   \
         _JS_CTYPE_ACH(at0),                                                                       \
     _JS_CTYPE_FLAGS(rt)
 
 #define JS_DEFINE_TRCINFO_1(name, tn0)                                                            \
     _JS_DEFINE_CALLINFO_n tn0                                                                     \
     JSTraceableNative name##_trcinfo[] = {                                                        \
-        { name, _JS_TN_INIT_HELPER_n tn0 }                                                        \
+        { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn0 }                                          \
     };
 
 #define JS_DEFINE_TRCINFO_2(name, tn0, tn1)                                                       \
     _JS_DEFINE_CALLINFO_n tn0                                                                     \
     _JS_DEFINE_CALLINFO_n tn1                                                                     \
     JSTraceableNative name##_trcinfo[] = {                                                        \
-        { name, _JS_TN_INIT_HELPER_n tn0 | JSTN_MORE },                                           \
-        { name, _JS_TN_INIT_HELPER_n tn1 }                                                        \
+        { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn0 | JSTN_MORE },                             \
+        { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn1 }                                          \
     };
 
 #define JS_DEFINE_TRCINFO_3(name, tn0, tn1, tn2)                                                  \
     _JS_DEFINE_CALLINFO_n tn0                                                                     \
     _JS_DEFINE_CALLINFO_n tn1                                                                     \
     _JS_DEFINE_CALLINFO_n tn2                                                                     \
     JSTraceableNative name##_trcinfo[] = {                                                        \
-        { name, _JS_TN_INIT_HELPER_n tn0 | JSTN_MORE },                                           \
-        { name, _JS_TN_INIT_HELPER_n tn1 | JSTN_MORE },                                           \
-        { name, _JS_TN_INIT_HELPER_n tn2 }                                                        \
+        { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn0 | JSTN_MORE },                             \
+        { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn1 | JSTN_MORE },                             \
+        { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn2 }                                          \
     };
 
 #define JS_DEFINE_TRCINFO_4(name, tn0, tn1, tn2, tn3)                                             \
     _JS_DEFINE_CALLINFO_n tn0                                                                     \
     _JS_DEFINE_CALLINFO_n tn1                                                                     \
     _JS_DEFINE_CALLINFO_n tn2                                                                     \
     _JS_DEFINE_CALLINFO_n tn3                                                                     \
     JSTraceableNative name##_trcinfo[] = {                                                        \
-        { name, _JS_TN_INIT_HELPER_n tn0 | JSTN_MORE },                                           \
-        { name, _JS_TN_INIT_HELPER_n tn1 | JSTN_MORE },                                           \
-        { name, _JS_TN_INIT_HELPER_n tn2 | JSTN_MORE },                                           \
-        { name, _JS_TN_INIT_HELPER_n tn3 }                                                        \
+        { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn0 | JSTN_MORE },                             \
+        { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn1 | JSTN_MORE },                             \
+        { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn2 | JSTN_MORE },                             \
+        { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn3 }                                          \
     };
 
 #define _JS_DEFINE_CALLINFO_n(n, args)  JS_DEFINE_CALLINFO_##n args
 
 jsdouble FASTCALL
 js_StringToNumber(JSContext* cx, JSString* str);
 
 jsdouble FASTCALL
@@ -379,41 +385,42 @@ js_Int32ToId(JSContext* cx, int32 index,
 #define JS_DECLARE_CALLINFO(name)
 #define JS_DEFINE_TRCINFO_1(name, tn0)
 #define JS_DEFINE_TRCINFO_2(name, tn0, tn1)
 #define JS_DEFINE_TRCINFO_3(name, tn0, tn1, tn2)
 #define JS_DEFINE_TRCINFO_4(name, tn0, tn1, tn2, tn3)
 
 #endif /* !JS_TRACER */
 
-/* Defined in jsarray.cpp */
+/* Defined in jsobj.cpp. */
+JS_DECLARE_CALLINFO(js_Object_tn)
+JS_DECLARE_CALLINFO(js_NewInstance)
+
+/* Defined in jsarray.cpp. */
+JS_DECLARE_CALLINFO(js_ArrayCompPush)
+JS_DECLARE_CALLINFO(js_Array_1str)
 JS_DECLARE_CALLINFO(js_Array_dense_setelem)
 JS_DECLARE_CALLINFO(js_FastNewArray)
+JS_DECLARE_CALLINFO(js_FastNewArrayWithLength)
 JS_DECLARE_CALLINFO(js_NewUninitializedArray)
-JS_DECLARE_CALLINFO(js_FastNewArrayWithLength)
-JS_DECLARE_CALLINFO(js_Array_1str)
-JS_DECLARE_CALLINFO(js_ArrayCompPush)
 
-/* Defined in jsdate.cpp */
-JS_DECLARE_CALLINFO(js_FastNewDate)
-
-/* Defined in jsnum.cpp */
+/* Defined in jsnum.cpp. */
 JS_DECLARE_CALLINFO(js_NumberToString)
 
-/* Defined in jsstr.cpp */
+/* Defined in jsstr.cpp. */
+JS_DECLARE_CALLINFO(js_CompareStrings)
 JS_DECLARE_CALLINFO(js_ConcatStrings)
+JS_DECLARE_CALLINFO(js_EqualStrings)
 JS_DECLARE_CALLINFO(js_String_getelem)
+JS_DECLARE_CALLINFO(js_String_p_charCodeAt)
 JS_DECLARE_CALLINFO(js_String_p_charCodeAt0)
 JS_DECLARE_CALLINFO(js_String_p_charCodeAt0_int)
-JS_DECLARE_CALLINFO(js_String_p_charCodeAt)
 JS_DECLARE_CALLINFO(js_String_p_charCodeAt_int)
-JS_DECLARE_CALLINFO(js_EqualStrings)
-JS_DECLARE_CALLINFO(js_CompareStrings)
 
-/* Defined in jsbuiltins.cpp */
+/* Defined in jsbuiltins.cpp. */
 #define BUILTIN1(linkage, rt, op, at0,                     cse, fold)  JS_DECLARE_CALLINFO(op)
 #define BUILTIN2(linkage, rt, op, at0, at1,                cse, fold)  JS_DECLARE_CALLINFO(op)
 #define BUILTIN3(linkage, rt, op, at0, at1, at2,           cse, fold)  JS_DECLARE_CALLINFO(op)
 #define BUILTIN4(linkage, rt, op, at0, at1, at2, at3,      cse, fold)  JS_DECLARE_CALLINFO(op)
 #define BUILTIN5(linkage, rt, op, at0, at1, at2, at3, at4, cse, fold)  JS_DECLARE_CALLINFO(op)
 #include "builtins.tbl"
 #undef BUILTIN
 #undef BUILTIN1

--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -572,25 +572,16 @@ struct JSRuntime {
 #define NATIVE_ENUM_CACHE_SIZE  JS_BIT(NATIVE_ENUM_CACHE_LOG2)
 
 #define NATIVE_ENUM_CACHE_HASH(shape)                                         \
     ((((shape) >> NATIVE_ENUM_CACHE_LOG2) ^ (shape)) & NATIVE_ENUM_CACHE_MASK)
 
     jsuword             nativeEnumCache[NATIVE_ENUM_CACHE_SIZE];
 
     /*
-     * Runtime-wide flag set to true when any Array prototype has an indexed
-     * property defined on it, creating a hazard for code reading or writing
-     * over a hole from a dense Array instance that is not prepared to look up
-     * the proto chain (the writing case must involve a check for a read-only
-     * element, which cannot be shadowed).
-     */
-    JSBool              anyArrayProtoHasElement;
-
-    /*
      * Various metering fields are defined at the end of JSRuntime. In this
      * way there is no need to recompile all the code that refers to other
      * fields of JSRuntime after enabling the corresponding metering macro.
      */
 #ifdef JS_DUMP_ENUM_CACHE_STATS
     int32               nativeEnumProbes;
     int32               nativeEnumMisses;
 # define ENUM_CACHE_METER(name)     JS_ATOMIC_INCREMENT(&cx->runtime->name)
@@ -773,22 +764,17 @@ typedef struct JSLocalRootStack {
  * Here single JSTVU_SINGLE covers both jsval and pointers to any GC-thing via
  * reinterpreting the thing as JSVAL_OBJECT. It works because the GC-thing is
  * aligned on a 0 mod 8 boundary, and object has the 0 jsval tag. So any
  * GC-thing may be tagged as if it were an object and untagged, if it's then
  * used only as an opaque pointer until discriminated by other means than tag
  * bits. This is how, for example, js_GetGCThingTraceKind uses its |thing|
  * parameter -- it consults GC-thing flags stored separately from the thing to
  * decide the kind of thing.
- *
- * The following checks that this type-punning is possible.
  */
-JS_STATIC_ASSERT(sizeof(JSTempValueUnion) == sizeof(jsval));
-JS_STATIC_ASSERT(sizeof(JSTempValueUnion) == sizeof(void *));
-
 #define JS_PUSH_TEMP_ROOT_COMMON(cx,x,tvr,cnt,kind)                           \
     JS_BEGIN_MACRO                                                            \
         JS_ASSERT((cx)->tempValueRooters != (tvr));                           \
         (tvr)->count = (cnt);                                                 \
         (tvr)->u.kind = (x);                                                  \
         (tvr)->down = (cx)->tempValueRooters;                                 \
         (cx)->tempValueRooters = (tvr);                                       \
     JS_END_MACRO

--- a/js/src/jsdate.cpp
+++ b/js/src/jsdate.cpp
@@ -2017,18 +2017,16 @@ date_valueOf(JSContext *cx, uintN argc, 
     if (!str)
         return JS_FALSE;
     number_str = ATOM_TO_STRING(cx->runtime->atomState.typeAtoms[JSTYPE_NUMBER]);
     if (js_EqualStrings(str, number_str))
         return date_getTime(cx, argc, vp);
     return date_toString(cx, argc, vp);
 }
 
-JS_DEFINE_CALLINFO_2(extern, OBJECT, js_FastNewDate, CONTEXT, OBJECT, 0, 0)
-
 // Don't really need an argument here, but we don't support arg-less builtins
 JS_DEFINE_TRCINFO_1(date_now,
     (1, (static, DOUBLE, date_now_tn, CONTEXT, 0, 0)))
 
 static JSFunctionSpec date_static_methods[] = {
     JS_FN("UTC",                 date_UTC,                MAXARGS,0),
     JS_FN("parse",               date_parse,              1,0),
     JS_TN("now",                 date_now,                0,0, date_now_trcinfo),
@@ -2167,57 +2165,55 @@ js_Date(JSContext *cx, JSObject *obj, ui
     }
     return JS_TRUE;
 }
 
 JS_STATIC_ASSERT(JSSLOT_PRIVATE == JSSLOT_UTC_TIME);
 JS_STATIC_ASSERT(JSSLOT_UTC_TIME + 1 == JSSLOT_LOCAL_TIME);
 
 #ifdef JS_TRACER
-JSObject* FASTCALL
-js_FastNewDate(JSContext* cx, JSObject* proto)
+
+static JSObject* FASTCALL
+Date_tn(JSContext* cx, JSObject* proto)
 {
     JS_ASSERT(JS_ON_TRACE(cx));
-    JSObject* obj = (JSObject*) js_NewGCThing(cx, GCX_OBJECT, sizeof(JSObject));
+    JSObject* obj = js_NewNativeObject(cx, &js_DateClass, proto, JSSLOT_LOCAL_TIME + 1);
     if (!obj)
         return NULL;
 
-    JSClass* clasp = &js_DateClass;
-    obj->classword = jsuword(clasp);
-
-    obj->fslots[JSSLOT_PROTO] = OBJECT_TO_JSVAL(proto);
-    obj->fslots[JSSLOT_PARENT] = proto->fslots[JSSLOT_PARENT];
-
     jsdouble* date = js_NewWeaklyRootedDouble(cx, 0.0);
     if (!date)
         return NULL;
     *date = date_now_tn(cx);
+
     obj->fslots[JSSLOT_UTC_TIME] = DOUBLE_TO_JSVAL(date);
     obj->fslots[JSSLOT_LOCAL_TIME] = DOUBLE_TO_JSVAL(cx->runtime->jsNaN);
-    for (unsigned i = JSSLOT_LOCAL_TIME + 1; i != JS_INITIAL_NSLOTS; ++i)
-        obj->fslots[i] = JSVAL_VOID;
-    
-    JS_ASSERT(!clasp->getObjectOps);
-    JS_ASSERT(proto->map->ops == &js_ObjectOps);
-    obj->map = js_HoldObjectMap(cx, proto->map);
-    obj->dslots = NULL;
     return obj;    
 }
-#endif
+
+JS_DEFINE_TRCINFO_1(js_Date,
+    (2, (static, CONSTRUCTOR_RETRY, Date_tn, CONTEXT, CALLEE_PROTOTYPE, 0, 0)))
+
+#else  /* !JS_TRACER */
+
+# define js_Date_trcinfo NULL
+
+#endif /* !JS_TRACER */
 
 JSObject *
 js_InitDateClass(JSContext *cx, JSObject *obj)
 {
     JSObject *proto;
     jsdouble *proto_date;
 
     /* set static LocalTZA */
     LocalTZA = -(PRMJ_LocalGMTDifference() * msPerSecond);
-    proto = JS_InitClass(cx, obj, NULL, &js_DateClass, js_Date, MAXARGS,
-                         NULL, date_methods, NULL, date_static_methods);
+    proto = js_InitClass(cx, obj, NULL, &js_DateClass, js_Date, MAXARGS,
+                         NULL, date_methods, NULL, date_static_methods,
+                         js_Date_trcinfo);
     if (!proto)
         return NULL;
 
     /* Alias toUTCString with toGMTString.  (ECMA B.2.6) */
     if (!JS_AliasProperty(cx, proto, "toUTCString", "toGMTString"))
         return NULL;
 
     /* Set the value of the Date.prototype date to NaN */

--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -2110,28 +2110,29 @@ js_NewFunction(JSContext *cx, JSObject *
         fun->u.i.nupvars = 0;
         fun->u.i.script = NULL;
 #ifdef DEBUG
         fun->u.i.names.taggedAtom = 0;
 #endif
     } else {
         fun->u.n.extra = 0;
         fun->u.n.spare = 0;
+        fun->u.n.clasp = NULL;
         if (flags & JSFUN_TRACEABLE) {
 #ifdef JS_TRACER
             JSTraceableNative *trcinfo =
                 JS_FUNC_TO_DATA_PTR(JSTraceableNative *, native);
             fun->u.n.native = (JSNative) trcinfo->native;
-            FUN_TRCINFO(fun) = trcinfo;
+            fun->u.n.trcinfo = trcinfo;
 #else
-            JS_ASSERT(0);
+            fun->u.n.trcinfo = NULL;
 #endif
         } else {
             fun->u.n.native = native;
-            FUN_CLASP(fun) = NULL;
+            fun->u.n.trcinfo = NULL;
         }
     }
     fun->atom = atom;
 
     /* Set private to self to indicate non-cloned fully initialized function. */
     FUN_OBJECT(fun)->fslots[JSSLOT_PRIVATE] = PRIVATE_TO_JSVAL(fun);
     return fun;
 }

--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -68,22 +68,20 @@ struct JSFunction {
     uint16          nargs;        /* maximum number of specified arguments,
                                      reflected as f.length/f.arity */
     uint16          flags;        /* flags, see JSFUN_* below and in jsapi.h */
     union {
         struct {
             uint16      extra;    /* number of arg slots for local GC roots */
             uint16      spare;    /* reserved for future use */
             JSNative    native;   /* native method pointer or null */
-            union {
-                JSClass             *clasp;    /* class of objects constructed
-                                                  by this function */
-                JSTraceableNative   *trcinfo;  /* tracer metadata; can be first
-                                                  element of array */
-            } u;
+            JSClass     *clasp;   /* class of objects constructed
+                                     by this function */
+            JSTraceableNative *trcinfo;  /* tracer metadata; can be first
+                                            element of array */
         } n;
         struct {
             uint16      nvars;    /* number of local variables */
             uint16      nupvars;  /* number of upvars (computable from script
                                      but here for faster access) */
             JSScript    *script;  /* interpreted bytecode descriptor or null */
             JSLocalNames names;   /* argument and variable names */
         } i;
@@ -106,21 +104,20 @@ struct JSFunction {
 #define FUN_NATIVE(fun)      (FUN_SLOW_NATIVE(fun) ? (fun)->u.n.native : NULL)
 #define FUN_FAST_NATIVE(fun) (((fun)->flags & JSFUN_FAST_NATIVE)              \
                               ? (JSFastNative) (fun)->u.n.native              \
                               : NULL)
 #define FUN_MINARGS(fun)     (((fun)->flags & JSFUN_FAST_NATIVE)              \
                               ? 0                                             \
                               : (fun)->nargs)
 #define FUN_CLASP(fun)       (JS_ASSERT(!FUN_INTERPRETED(fun)),               \
-                              JS_ASSERT(!((fun)->flags & JSFUN_TRACEABLE)),   \
-                              fun->u.n.u.clasp)
+                              fun->u.n.clasp)
 #define FUN_TRCINFO(fun)     (JS_ASSERT(!FUN_INTERPRETED(fun)),               \
                               JS_ASSERT((fun)->flags & JSFUN_TRACEABLE),      \
-                              fun->u.n.u.trcinfo)
+                              fun->u.n.trcinfo)
 
 /*
  * Traceable native.  This expands to a JSFunctionSpec initializer (like JS_FN
  * in jsapi.h).  fastcall is a JSFastNative; trcinfo is a JSTraceableNative *.
  */
 #ifdef JS_TRACER
 /* MSVC demands the intermediate (void *) cast here. */
 # define JS_TN(name,fastcall,nargs,flags,trcinfo)                             \

--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -127,16 +127,57 @@ extern "C" {
 #   if JS_GC_USE_MMAP
 #    error "JS_GC_USE_MMAP is set when mmap is not available"
 #   endif
 #  endif
 # endif
 #endif
 
 /*
+ * Check JSTempValueUnion has the size of jsval and void * so we can
+ * reinterpret jsval as void* GC-thing pointer and use JSTVU_SINGLE for
+ * different GC-things.
+ */
+JS_STATIC_ASSERT(sizeof(JSTempValueUnion) == sizeof(jsval));
+JS_STATIC_ASSERT(sizeof(JSTempValueUnion) == sizeof(void *));
+
+
+/*
+ * Check that JSTRACE_XML follows JSTRACE_OBJECT, JSTRACE_DOUBLE and
+ * JSTRACE_STRING.
+ */
+JS_STATIC_ASSERT(JSTRACE_OBJECT == 0);
+JS_STATIC_ASSERT(JSTRACE_DOUBLE == 1);
+JS_STATIC_ASSERT(JSTRACE_STRING == 2);
+JS_STATIC_ASSERT(JSTRACE_XML    == 3);
+
+/*
+ * JS_IS_VALID_TRACE_KIND assumes that JSTRACE_STRING is the last non-xml
+ * trace kind when JS_HAS_XML_SUPPORT is false.
+ */
+JS_STATIC_ASSERT(JSTRACE_STRING + 1 == JSTRACE_XML);
+
+/*
+ * The number of used GCX-types must stay within GCX_LIMIT.
+ */
+JS_STATIC_ASSERT(GCX_NTYPES <= GCX_LIMIT);
+
+
+/*
+ * Check that we can reinterpret double as JSGCDoubleCell.
+ */
+JS_STATIC_ASSERT(sizeof(JSGCDoubleCell) == sizeof(double));
+
+/*
+ * Check that we can use memset(p, 0, ...) to implement JS_CLEAR_WEAK_ROOTS.
+ */
+JS_STATIC_ASSERT(JSVAL_NULL == 0);
+
+
+/*
  * A GC arena contains a fixed number of flag bits for each thing in its heap,
  * and supports O(1) lookup of a flag given its thing's address.
  *
  * To implement this, we allocate things of the same size from a GC arena
  * containing GC_ARENA_SIZE bytes aligned on GC_ARENA_SIZE boundary. The
  * following picture shows arena's layout:
  *
  *  +------------------------------+--------------------+---------------+

--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -45,18 +45,16 @@
 #include "jsprvtd.h"
 #include "jspubtd.h"
 #include "jsdhash.h"
 #include "jsbit.h"
 #include "jsutil.h"
 
 JS_BEGIN_EXTERN_C
 
-JS_STATIC_ASSERT(JSTRACE_STRING == 2);
-
 #define JSTRACE_XML         3
 
 /*
  * One past the maximum trace kind.
  */
 #define JSTRACE_LIMIT       4
 
 /*
@@ -65,28 +63,23 @@ JS_STATIC_ASSERT(JSTRACE_STRING == 2);
  */
 #define GCX_OBJECT              JSTRACE_OBJECT      /* JSObject */
 #define GCX_DOUBLE              JSTRACE_DOUBLE      /* jsdouble */
 #define GCX_STRING              JSTRACE_STRING      /* JSString */
 #define GCX_XML                 JSTRACE_XML         /* JSXML */
 #define GCX_EXTERNAL_STRING     JSTRACE_LIMIT       /* JSString with external
                                                        chars */
 /*
- * The number of defined GC types.
+ * The number of defined GC types and the maximum limit for the number of
+ * possible GC types.
  */
 #define GCX_NTYPES              (GCX_EXTERNAL_STRING + 8)
-
-/*
- * The maximum limit for the number of GC types.
- */
 #define GCX_LIMIT_LOG2         4           /* type index bits */
 #define GCX_LIMIT              JS_BIT(GCX_LIMIT_LOG2)
 
-JS_STATIC_ASSERT(GCX_NTYPES <= GCX_LIMIT);
-
 /* GC flag definitions, must fit in 8 bits (type index goes in the low bits). */
 #define GCF_TYPEMASK    JS_BITMASK(GCX_LIMIT_LOG2)
 #define GCF_MARK        JS_BIT(GCX_LIMIT_LOG2)
 #define GCF_FINAL       JS_BIT(GCX_LIMIT_LOG2 + 1)
 #define GCF_LOCKSHIFT   (GCX_LIMIT_LOG2 + 2)   /* lock bit shift */
 #define GCF_LOCK        JS_BIT(GCF_LOCKSHIFT)   /* lock request bit in API */
 
 /*
@@ -233,22 +226,16 @@ js_IsAboutToBeFinalized(JSContext *cx, v
 
 #if JS_HAS_XML_SUPPORT
 # define JS_IS_VALID_TRACE_KIND(kind) ((uint32)(kind) < JSTRACE_LIMIT)
 #else
 # define JS_IS_VALID_TRACE_KIND(kind) ((uint32)(kind) <= JSTRACE_STRING)
 #endif
 
 /*
- * JS_IS_VALID_TRACE_KIND assumes that JSTRACE_STRING is the last non-xml
- * trace kind when JS_HAS_XML_SUPPORT is false.
- */
-JS_STATIC_ASSERT(JSTRACE_STRING + 1 == JSTRACE_XML);
-
-/*
  * Trace jsval when JSVAL_IS_OBJECT(v) can be an arbitrary GC thing casted as
  * JSVAL_OBJECT and js_GetGCThingTraceKind has to be used to find the real
  * type behind v.
  */
 extern void
 js_CallValueTracerIfGCThing(JSTracer *trc, jsval v);
 
 extern void
@@ -330,18 +317,16 @@ struct JSGCArenaList {
 
 typedef union JSGCDoubleCell JSGCDoubleCell;
 
 union JSGCDoubleCell {
     double          number;
     JSGCDoubleCell  *link;
 };
 
-JS_STATIC_ASSERT(sizeof(JSGCDoubleCell) == sizeof(double));
-
 typedef struct JSGCDoubleArenaList {
     JSGCArenaInfo   *first;             /* first allocated GC arena */
     jsbitmap        *nextDoubleFlags;   /* bitmask with flags to check for free
                                            things */
 } JSGCDoubleArenaList;
 
 typedef struct JSGCFreeListSet JSGCFreeListSet;
 
@@ -361,17 +346,16 @@ struct JSWeakRoots {
 
     /* Atom root for the last-looked-up atom on this context. */
     jsval           lastAtom;
 
     /* Root for the result of the most recent js_InternalInvoke call. */
     jsval           lastInternalResult;
 };
 
-JS_STATIC_ASSERT(JSVAL_NULL == 0);
 #define JS_CLEAR_WEAK_ROOTS(wr) (memset((wr), 0, sizeof(JSWeakRoots)))
 
 /*
  * Increase runtime->gcBytes by sz bytes to account for an allocation outside
  * the GC that will be freed only after the GC is run. The function may run
  * the last ditch GC to ensure that gcBytes does not exceed gcMaxBytes. It will
  * fail if the latter is not possible.
  *

--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -1783,21 +1783,18 @@ js_InvokeConstructor(JSContext *cx, uint
             return JS_FALSE;
         }
         rval = vp[1];
         proto = JSVAL_IS_OBJECT(rval) ? JSVAL_TO_OBJECT(rval) : NULL;
         parent = OBJ_GET_PARENT(cx, obj2);
 
         if (OBJ_GET_CLASS(cx, obj2) == &js_FunctionClass) {
             fun2 = GET_FUNCTION_PRIVATE(cx, obj2);
-            if (!FUN_INTERPRETED(fun2) &&
-                !(fun2->flags & JSFUN_TRACEABLE) &&
-                fun2->u.n.u.clasp) {
-                clasp = fun2->u.n.u.clasp;
-            }
+            if (!FUN_INTERPRETED(fun2) && fun2->u.n.clasp)
+                clasp = fun2->u.n.clasp;
         }
     }
     obj = js_NewObject(cx, clasp, proto, parent, 0);
     if (!obj)
         return JS_FALSE;
 
     /* Now we have an object with a constructor method; call it. */
     vp[1] = OBJECT_TO_JSVAL(obj);
@@ -4261,17 +4258,17 @@ js_Interpret(JSContext *cx)
           do_getprop_with_lval:
             VALUE_TO_OBJECT(cx, -1, lval, obj);
 
           do_getprop_with_obj:
             do {
                 JSObject *aobj;
                 JSPropCacheEntry *entry;
 
-                aobj = OBJ_IS_DENSE_ARRAY(cx, obj) ? OBJ_GET_PROTO(cx, obj) : obj;
+                aobj = js_GetProtoIfDenseArray(cx, obj);
                 if (JS_LIKELY(aobj->map->ops->getProperty == js_GetProperty)) {
                     PROPERTY_CACHE_TEST(cx, regs.pc, aobj, obj2, entry, atom);
                     if (!atom) {
                         ASSERT_VALID_PROPERTY_CACHE_HIT(i, aobj, obj2, entry);
                         if (PCVAL_IS_OBJECT(entry->vword)) {
                             rval = PCVAL_OBJECT_TO_JSVAL(entry->vword);
                         } else if (PCVAL_IS_SLOT(entry->vword)) {
                             slot = PCVAL_TO_SLOT(entry->vword);
@@ -4289,17 +4286,17 @@ js_Interpret(JSContext *cx)
                     entry = NULL;
                     if (i < 0)
                         atom = rt->atomState.lengthAtom;
                     else
                         LOAD_ATOM(i);
                 }
                 id = ATOM_TO_JSID(atom);
                 if (entry
-                    ? !js_GetPropertyHelper(cx, aobj, id, &rval, &entry)
+                    ? !js_GetPropertyHelper(cx, obj, id, &rval, &entry)
                     : !OBJ_GET_PROPERTY(cx, obj, id, &rval)) {
                     goto error;
                 }
             } while (0);
 
             STORE_OPND(-1, rval);
             JS_ASSERT(JSOP_GETPROP_LENGTH + i == js_CodeSpec[op].length);
             len = JSOP_GETPROP_LENGTH + i;
@@ -4352,17 +4349,17 @@ js_Interpret(JSContext *cx)
                     js_ReportIsNullOrUndefined(cx, -1, lval, NULL);
                     goto error;
                 }
 
                 if (!js_GetClassPrototype(cx, NULL, INT_TO_JSID(i), &obj))
                     goto error;
             }
 
-            aobj = OBJ_IS_DENSE_ARRAY(cx, obj) ? OBJ_GET_PROTO(cx, obj) : obj;
+            aobj = js_GetProtoIfDenseArray(cx, obj);
             if (JS_LIKELY(aobj->map->ops->getProperty == js_GetProperty)) {
                 PROPERTY_CACHE_TEST(cx, regs.pc, aobj, obj2, entry, atom);
                 if (!atom) {
                     ASSERT_VALID_PROPERTY_CACHE_HIT(0, aobj, obj2, entry);
                     if (PCVAL_IS_OBJECT(entry->vword)) {
                         rval = PCVAL_OBJECT_TO_JSVAL(entry->vword);
                     } else if (PCVAL_IS_SLOT(entry->vword)) {
                         slot = PCVAL_TO_SLOT(entry->vword);
@@ -4397,17 +4394,17 @@ js_Interpret(JSContext *cx)
 
                     ops = (JSXMLObjectOps *) obj->map->ops;
                     obj = ops->getMethod(cx, obj, id, &rval);
                     if (!obj)
                         goto error;
                 } else
 #endif
                 if (entry
-                    ? !js_GetPropertyHelper(cx, aobj, id, &rval, &entry)
+                    ? !js_GetPropertyHelper(cx, obj, id, &rval, &entry)
                     : !OBJ_GET_PROPERTY(cx, obj, id, &rval)) {
                     goto error;
                 }
                 STORE_OPND(-1, OBJECT_TO_JSVAL(obj));
                 STORE_OPND(-2, rval);
             } else {
                 JS_ASSERT(obj->map->ops->getProperty == js_GetProperty);
                 if (!js_GetPropertyHelper(cx, obj, id, &rval, &entry))
@@ -4587,16 +4584,25 @@ js_Interpret(JSContext *cx)
                                     scope->lastProp = sprop;
                                 }
 
                                 GC_WRITE_BARRIER(cx, scope,
                                                  LOCKED_OBJ_GET_SLOT(obj, slot),
                                                  rval);
                                 LOCKED_OBJ_SET_SLOT(obj, slot, rval);
                                 JS_UNLOCK_SCOPE(cx, scope);
+
+                                /*
+                                 * Purge the property cache of the id we may
+                                 * have just shadowed in obj's scope and proto
+                                 * chains. We do this after unlocking obj's
+                                 * scope to avoid lock nesting.
+                                 */
+                                js_PurgeScopeChain(cx, obj, sprop->id);
+
                                 TRACE_2(SetPropHit, entry, sprop);
                                 break;
                             }
 
                             PCMETER(cache->setpcmisses++);
                             atom = NULL;
                         }
 
@@ -4720,17 +4726,17 @@ js_Interpret(JSContext *cx)
             do {
                 if (OBJ_IS_DENSE_ARRAY(cx, obj) && JSID_IS_INT(id)) {
                     jsuint length;
 
                     length = js_DenseArrayCapacity(obj);
                     i = JSID_TO_INT(id);
                     if ((jsuint)i < length) {
                         if (obj->dslots[i] == JSVAL_HOLE) {
-                            if (rt->anyArrayProtoHasElement)
+                            if (js_PrototypeHasIndexedProperties(cx, obj))
                                 break;
                             if (i >= obj->fslots[JSSLOT_ARRAY_LENGTH])
                                 obj->fslots[JSSLOT_ARRAY_LENGTH] = i + 1;
                             obj->fslots[JSSLOT_ARRAY_COUNT]++;
                         }
                         obj->dslots[i] = rval;
                         goto end_setelem;
                     }
@@ -6173,18 +6179,16 @@ js_Interpret(JSContext *cx)
                     /*
                      * Detect a repeated property name and force a miss to
                      * share the strict warning code and cope with complexity
                      * managed by js_AddScopeProperty.
                      */
                     if (sprop->parent != scope->lastProp)
                         goto do_initprop_miss;
 
-                    TRACE_2(SetPropHit, entry, sprop);
-
                     /*
                      * Otherwise this entry must be for a direct property of
                      * obj, not a proto-property, and there cannot have been
                      * any deletions of prior properties.
                      */
                     JS_ASSERT(PCVCAP_MAKE(sprop->shape, 0, 0) == entry->vcap);
                     JS_ASSERT(!SCOPE_HAD_MIDDLE_DELETE(scope));
                     JS_ASSERT(!scope->table ||
@@ -6222,16 +6226,18 @@ js_Interpret(JSContext *cx)
                         scope->lastProp = sprop;
                     }
 
                     GC_WRITE_BARRIER(cx, scope,
                                      LOCKED_OBJ_GET_SLOT(obj, slot),
                                      rval);
                     LOCKED_OBJ_SET_SLOT(obj, slot, rval);
                     JS_UNLOCK_SCOPE(cx, scope);
+
+                    TRACE_2(SetPropHit, entry, sprop);
                     break;
                 }
 
               do_initprop_miss:
                 PCMETER(cache->inipcmisses++);
                 JS_UNLOCK_SCOPE(cx, scope);
 
                 /* Get the immediate property name into id. */

--- a/js/src/jslock.cpp
+++ b/js/src/jslock.cpp
@@ -51,16 +51,21 @@
 #include "jscntxt.h"
 #include "jsdtoa.h"
 #include "jsgc.h"
 #include "jsfun.h"      /* for VALUE_IS_FUNCTION used by *_WRITE_BARRIER */
 #include "jslock.h"
 #include "jsscope.h"
 #include "jsstr.h"
 
+/*
+ * Check that we can cast the data after JSObjectMap as JSTitle.
+ */
+JS_STATIC_ASSERT(offsetof(JSScope, title) == sizeof(JSObjectMap));
+
 #define ReadWord(W) (W)
 
 /* Implement NativeCompareAndSwap. */
 
 #if defined(_WIN32) && defined(_M_IX86)
 #pragma warning( disable : 4035 )
 JS_BEGIN_EXTERN_C
 extern long __cdecl

--- a/js/src/jslog2.cpp
+++ b/js/src/jslog2.cpp
@@ -35,31 +35,48 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "jsbit.h"
 #include "jsutil.h"
 
 /*
-** Compute the log of the least power of 2 greater than or equal to n
-*/
-JS_PUBLIC_API(JSIntn) JS_CeilingLog2(JSUint32 n)
+ * Check that we can use js_bitscan_clz32 to implement JS_FLOOR_LOG2 and
+ * JS_FLOOR_LOG2W and js_bitscan_clz64 to implement JS_FLOOR_LOG2W on 64-bit
+ * systems.
+ */
+#ifdef JS_HAS_BUILTIN_BITSCAN32
+JS_STATIC_ASSERT(sizeof(unsigned int) == sizeof(JSUint32));
+JS_STATIC_ASSERT_IF(JS_BYTES_PER_WORD == 4,
+                    sizeof(unsigned int) == sizeof(JSUword));
+#endif
+#ifdef JS_HAS_BUILTIN_BITSCAN64
+JS_STATIC_ASSERT_IF(JS_BYTES_PER_WORD == 8,
+                    sizeof(unsigned long long) == sizeof(JSUword));
+#endif
+
+/*
+ * Compute the log of the least power of 2 greater than or equal to n
+ */
+JS_PUBLIC_API(JSIntn)
+JS_CeilingLog2(JSUint32 n)
 {
     JSIntn log2;
 
     JS_CEILING_LOG2(log2, n);
     return log2;
 }
 
 /*
-** Compute the log of the greatest power of 2 less than or equal to n.
-** This really just finds the highest set bit in the word.
-*/
-JS_PUBLIC_API(JSIntn) JS_FloorLog2(JSUint32 n)
+ * Compute the log of the greatest power of 2 less than or equal to n.
+ * This really just finds the highest set bit in the word.
+ */
+JS_PUBLIC_API(JSIntn)
+JS_FloorLog2(JSUint32 n)
 {
     JSIntn log2;
 
     JS_FLOOR_LOG2(log2, n);
     return log2;
 }
 
 /*

--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -316,33 +316,16 @@ js_SetProtoOrParent(JSContext *cx, JSObj
 #else
                                  (slot == JSSLOT_PROTO) ? js_proto_str
                                                         : js_parent_str
 #endif
                                  );
         }
         return JS_FALSE;
     }
-
-    /*
-     * Maintain the "any Array prototype has indexed properties hazard" flag by
-     * conservatively setting it. We simply don't know what pobj has in the way
-     * of indexed properties, either directly or along its prototype chain, and
-     * we won't expend effort here to find out. We do know that if obj is not
-     * an array or a prototype (delegate), then we're ok. And, of course, pobj
-     * must be non-null.
-     *
-     * This pessimistic approach could be improved, but setting __proto__ is
-     * quite rare and arguably deserving of deoptimization.
-     */
-    if (slot == JSSLOT_PROTO &&
-        pobj &&
-        (OBJ_IS_ARRAY(cx, obj) || OBJ_IS_DELEGATE(cx, obj))) {
-        rt->anyArrayProtoHasElement = JS_TRUE;
-    }
     return JS_TRUE;
 }
 
 static JSHashNumber
 js_hash_object(const void *key)
 {
     return (JSHashNumber)JS_PTR_TO_UINT32(key) >> JSVAL_TAGBITS;
 }
@@ -2016,16 +1999,101 @@ js_Object(JSContext *cx, JSObject *obj, 
         obj = js_NewObject(cx, &js_ObjectClass, NULL, NULL, 0);
         if (!obj)
             return JS_FALSE;
     }
     *rval = OBJECT_TO_JSVAL(obj);
     return JS_TRUE;
 }
 
+#ifdef JS_TRACER
+
+static inline JSObject*
+NewNativeObject(JSContext* cx, JSObject* proto, JSObject *parent)
+{
+    JS_ASSERT(JS_ON_TRACE(cx));
+    JSObject* obj = (JSObject*) js_NewGCThing(cx, GCX_OBJECT, sizeof(JSObject));
+    if (!obj)
+        return NULL;
+
+    obj->classword = jsuword(&js_ObjectClass);
+    obj->fslots[JSSLOT_PROTO] = OBJECT_TO_JSVAL(proto);
+    obj->fslots[JSSLOT_PARENT] = OBJECT_TO_JSVAL(parent);
+    for (unsigned i = JSSLOT_PRIVATE; i < JS_INITIAL_NSLOTS; ++i)
+        obj->fslots[i] = JSVAL_VOID;
+
+    JS_ASSERT(!OBJ_GET_CLASS(cx, proto)->getObjectOps);
+    JS_ASSERT(proto->map->ops == &js_ObjectOps);
+    obj->map = js_HoldObjectMap(cx, proto->map);
+    obj->dslots = NULL;
+    return obj;
+}
+
+JSObject* FASTCALL
+js_Object_tn(JSContext* cx, JSObject* proto)
+{
+    return NewNativeObject(cx, proto, JSVAL_TO_OBJECT(proto->fslots[JSSLOT_PARENT]));
+}
+
+JS_DEFINE_TRCINFO_1(js_Object,
+    (2, (extern, CONSTRUCTOR_RETRY, js_Object_tn, CONTEXT, CALLEE_PROTOTYPE, 0, 0)))
+
+JSObject* FASTCALL
+js_NewInstance(JSContext* cx, JSObject *ctor)
+{
+    JS_ASSERT(HAS_FUNCTION_CLASS(ctor));
+#ifdef DEBUG
+    JSFunction* fun = GET_FUNCTION_PRIVATE(cx, ctor);
+    JS_ASSERT(FUN_INTERPRETED(fun));
+#endif
+
+    JSAtom* atom = cx->runtime->atomState.classPrototypeAtom;
+
+    JS_LOCK_OBJ(cx, ctor);
+    JSScope *scope = OBJ_SCOPE(ctor);
+    if (scope->object != ctor) {
+        scope = js_GetMutableScope(cx, ctor);
+        if (!scope)
+            return NULL;
+    }
+
+    JSScopeProperty* sprop = SCOPE_GET_PROPERTY(scope, ATOM_TO_JSID(atom));
+    jsval pval = sprop ? LOCKED_OBJ_GET_SLOT(ctor, sprop->slot) : JSVAL_HOLE;
+    JS_UNLOCK_SCOPE(cx, scope);
+
+    JSObject* proto;
+    if (!JSVAL_IS_PRIMITIVE(pval)) {
+        /* An object in ctor.prototype, let's use it as the new instance's proto. */
+        proto = JSVAL_TO_OBJECT(pval);
+    } else if (pval == JSVAL_HOLE) {
+        /* No ctor.prototype yet, inline and optimize fun_resolve's prototype code. */
+        proto = js_NewObject(cx, &js_ObjectClass, NULL, OBJ_GET_PARENT(cx, ctor), 0);
+        if (!proto)
+            return NULL;
+        if (!js_SetClassPrototype(cx, ctor, proto, JSPROP_ENUMERATE | JSPROP_PERMANENT))
+            return NULL;
+    } else {
+        /* Primitive value in .prototype means we use Object.prototype for proto. */
+        if (!js_GetClassPrototype(cx, JSVAL_TO_OBJECT(ctor->fslots[JSSLOT_PARENT]),
+                                  INT_TO_JSID(JSProto_Object), &proto)) {
+            return NULL;
+        }
+    }
+
+    return NewNativeObject(cx, proto, JSVAL_TO_OBJECT(ctor->fslots[JSSLOT_PARENT]));
+}
+
+JS_DEFINE_CALLINFO_2(extern, CONSTRUCTOR_RETRY, js_NewInstance, CONTEXT, CALLEE_PROTOTYPE, 0, 0)
+
+#else  /* !JS_TRACER */
+
+# define js_Object_trcinfo NULL
+
+#endif /* !JS_TRACER */
+
 /*
  * Given pc pointing after a property accessing bytecode, return true if the
  * access is "object-detecting" in the sense used by web scripts, e.g., when
  * checking whether document.all is defined.
  */
 static JS_REQUIRES_STACK JSBool
 Detecting(JSContext *cx, jsbytecode *pc)
 {
@@ -2588,19 +2656,167 @@ js_InitEval(JSContext *cx, JSObject *obj
     }
 
     return obj;
 }
 
 JSObject *
 js_InitObjectClass(JSContext *cx, JSObject *obj)
 {
-    return JS_InitClass(cx, obj, NULL, &js_ObjectClass, js_Object, 1,
-                        object_props, object_methods, NULL,
-                        object_static_methods);
+    return js_InitClass(cx, obj, NULL, &js_ObjectClass, js_Object, 1,
+                        object_props, object_methods, NULL, object_static_methods,
+                        js_Object_trcinfo);
+}
+
+JSObject *
+js_InitClass(JSContext *cx, JSObject *obj, JSObject *parent_proto,
+             JSClass *clasp, JSNative constructor, uintN nargs,
+             JSPropertySpec *ps, JSFunctionSpec *fs,
+             JSPropertySpec *static_ps, JSFunctionSpec *static_fs,
+             JSTraceableNative *trcinfo)
+{
+    JSAtom *atom;
+    JSProtoKey key;
+    JSObject *proto, *ctor;
+    JSTempValueRooter tvr;
+    jsval cval, rval;
+    JSBool named;
+    JSFunction *fun;
+
+    atom = js_Atomize(cx, clasp->name, strlen(clasp->name), 0);
+    if (!atom)
+        return NULL;
+
+    /*
+     * When initializing a standard class, if no parent_proto (grand-proto of
+     * instances of the class, parent-proto of the class's prototype object)
+     * is given, we must use Object.prototype if it is available.  Otherwise,
+     * we could look up the wrong binding for a class name in obj.  Example:
+     *
+     *   String = Array;
+     *   print("hi there".join);
+     *
+     * should print undefined, not Array.prototype.join.  This is required by
+     * ECMA-262, alas.  It might have been better to make String readonly and
+     * permanent in the global object, instead -- but that's too big a change
+     * to swallow at this point.
+     */
+    key = JSCLASS_CACHED_PROTO_KEY(clasp);
+    if (key != JSProto_Null &&
+        !parent_proto &&
+        !js_GetClassPrototype(cx, obj, INT_TO_JSID(JSProto_Object),
+                              &parent_proto)) {
+        return NULL;
+    }
+
+    /* Create a prototype object for this class. */
+    proto = js_NewObject(cx, clasp, parent_proto, obj, 0);
+    if (!proto)
+        return NULL;
+
+    /* After this point, control must exit via label bad or out. */
+    JS_PUSH_TEMP_ROOT_OBJECT(cx, proto, &tvr);
+
+    if (!constructor) {
+        JS_ASSERT(!trcinfo);
+
+        /*
+         * Lacking a constructor, name the prototype (e.g., Math) unless this
+         * class (a) is anonymous, i.e. for internal use only; (b) the class
+         * of obj (the global object) is has a reserved slot indexed by key;
+         * and (c) key is not the null key.
+         */
+        if ((clasp->flags & JSCLASS_IS_ANONYMOUS) &&
+            (OBJ_GET_CLASS(cx, obj)->flags & JSCLASS_IS_GLOBAL) &&
+            key != JSProto_Null) {
+            named = JS_FALSE;
+        } else {
+            named = OBJ_DEFINE_PROPERTY(cx, obj, ATOM_TO_JSID(atom),
+                                        OBJECT_TO_JSVAL(proto),
+                                        JS_PropertyStub, JS_PropertyStub,
+                                        (clasp->flags & JSCLASS_IS_ANONYMOUS)
+                                        ? JSPROP_READONLY | JSPROP_PERMANENT
+                                        : 0,
+                                        NULL);
+            if (!named)
+                goto bad;
+        }
+
+        ctor = proto;
+    } else {
+        /* Define the constructor function in obj's scope. */
+        fun = js_DefineFunction(cx, obj, atom, constructor, nargs,
+                                JSFUN_STUB_GSOPS);
+        named = (fun != NULL);
+        if (!fun)
+            goto bad;
+
+        /*
+         * Remember the class this function is a constructor for so that
+         * we know to create an object of this class when we call the
+         * constructor.
+         */
+        FUN_CLASP(fun) = clasp;
+
+        /*
+         * If we have a traceable native constructor, update the function to
+         * point at the given trcinfo and flag it.
+         */
+        if (trcinfo) {
+            fun->u.n.trcinfo = trcinfo;
+            fun->flags |= JSFUN_TRACEABLE;
+        }
+
+        /*
+         * Optionally construct the prototype object, before the class has
+         * been fully initialized.  Allow the ctor to replace proto with a
+         * different object, as is done for operator new -- and as at least
+         * XML support requires.
+         */
+        ctor = FUN_OBJECT(fun);
+        if (clasp->flags & JSCLASS_CONSTRUCT_PROTOTYPE) {
+            cval = OBJECT_TO_JSVAL(ctor);
+            if (!js_InternalConstruct(cx, proto, cval, 0, NULL, &rval))
+                goto bad;
+            if (!JSVAL_IS_PRIMITIVE(rval) && JSVAL_TO_OBJECT(rval) != proto)
+                proto = JSVAL_TO_OBJECT(rval);
+        }
+
+        /* Connect constructor and prototype by named properties. */
+        if (!js_SetClassPrototype(cx, ctor, proto,
+                                  JSPROP_READONLY | JSPROP_PERMANENT)) {
+            goto bad;
+        }
+
+        /* Bootstrap Function.prototype (see also JS_InitStandardClasses). */
+        if (OBJ_GET_CLASS(cx, ctor) == clasp)
+            OBJ_SET_PROTO(cx, ctor, proto);
+    }
+
+    /* Add properties and methods to the prototype and the constructor. */
+    if ((ps && !JS_DefineProperties(cx, proto, ps)) ||
+        (fs && !JS_DefineFunctions(cx, proto, fs)) ||
+        (static_ps && !JS_DefineProperties(cx, ctor, static_ps)) ||
+        (static_fs && !JS_DefineFunctions(cx, ctor, static_fs))) {
+        goto bad;
+    }
+
+    /* If this is a standard class, cache its prototype. */
+    if (key != JSProto_Null && !js_SetClassObject(cx, obj, key, ctor))
+        goto bad;
+
+out:
+    JS_POP_TEMP_ROOT(cx, &tvr);
+    return proto;
+
+bad:
+    if (named)
+        (void) OBJ_DELETE_PROPERTY(cx, obj, ATOM_TO_JSID(atom), &rval);
+    proto = NULL;
+    goto out;
 }
 
 void
 js_InitObjectMap(JSObjectMap *map, jsrefcount nrefs, JSObjectOps *ops,
                  JSClass *clasp)
 {
     map->nrefs = nrefs;
     map->ops = ops;
@@ -2872,17 +3088,17 @@ js_NewObjectWithGivenProto(JSContext *cx
     JS_ASSERT(!STOBJ_IS_DELEGATE(obj));
     JS_ASSERT(!STOBJ_IS_SYSTEM(obj));
 
     /* Set the proto and parent properties. */
     STOBJ_SET_PROTO(obj, proto);
     STOBJ_SET_PARENT(obj, parent);
 
     /* Initialize the remaining fixed slots. */
-    for (i = JSSLOT_PRIVATE; i != JS_INITIAL_NSLOTS; ++i)
+    for (i = JSSLOT_PRIVATE; i < JS_INITIAL_NSLOTS; ++i)
         obj->fslots[i] = JSVAL_VOID;
 
 #ifdef DEBUG
     memset((uint8 *) obj + sizeof(JSObject), JS_FREE_PATTERN,
            objectSize - sizeof(JSObject));
 #endif
 
     /*
@@ -2966,16 +3182,38 @@ earlybad:
     if (JAVASCRIPT_OBJECT_CREATE_ENABLED())
         jsdtrace_object_create(cx, clasp, NULL);
     if (JAVASCRIPT_OBJECT_CREATE_DONE_ENABLED())
         jsdtrace_object_create_done(cx->fp, clasp);
 #endif
     return NULL;
 }
 
+JSObject*
+js_NewNativeObject(JSContext *cx, JSClass *clasp, JSObject *proto, uint32 slot)
+{
+    JSObject* obj = (JSObject*) js_NewGCThing(cx, GCX_OBJECT, sizeof(JSObject));
+    if (!obj)
+        return NULL;
+
+    obj->classword = jsuword(clasp);
+    obj->fslots[JSSLOT_PROTO] = OBJECT_TO_JSVAL(proto);
+    obj->fslots[JSSLOT_PARENT] = proto->fslots[JSSLOT_PARENT];
+
+    JS_ASSERT(slot > JSSLOT_PARENT);
+    while (slot < JS_INITIAL_NSLOTS)
+        obj->fslots[slot++] = JSVAL_VOID;
+
+    JS_ASSERT(!clasp->getObjectOps);
+    JS_ASSERT(proto->map->ops == &js_ObjectOps);
+    obj->map = js_HoldObjectMap(cx, proto->map);
+    obj->dslots = NULL;
+    return obj;
+}
+
 JS_BEGIN_EXTERN_C
 
 static JSObject *
 js_InitNullClass(JSContext *cx, JSObject *obj)
 {
     JS_ASSERT(0);
     return NULL;
 }
@@ -3338,21 +3576,20 @@ PurgeProtoChain(JSContext *cx, JSObject 
             return JS_TRUE;
         }
         obj = LOCKED_OBJ_GET_PROTO(scope->object);
         JS_UNLOCK_SCOPE(cx, scope);
     }
     return JS_FALSE;
 }
 
-static void
-PurgeScopeChain(JSContext *cx, JSObject *obj, jsid id)
+void
+js_PurgeScopeChainHelper(JSContext *cx, JSObject *obj, jsid id)
 {
-    if (!OBJ_IS_DELEGATE(cx, obj))
-        return;
+    JS_ASSERT(OBJ_IS_DELEGATE(cx, obj));
 
     /*
      * All scope chains end in a global object, so this will change the global
      * shape. jstracer.cpp assumes that the global shape never changes on
      * trace, so we must deep-bail here.
      */
     js_LeaveTrace(cx);
 
@@ -3371,17 +3608,17 @@ js_AddNativeProperty(JSContext *cx, JSOb
     JSScope *scope;
     JSScopeProperty *sprop;
 
     /*
      * Purge the property cache of now-shadowed id in obj's scope chain. Do
      * this optimistically (assuming no failure below) before locking obj, so
      * we can lock the shadowed scope.
      */
-    PurgeScopeChain(cx, obj, id);
+    js_PurgeScopeChain(cx, obj, id);
 
     JS_LOCK_OBJ(cx, obj);
     scope = js_GetMutableScope(cx, obj);
     if (!scope) {
         sprop = NULL;
     } else {
         /* Convert string indices to integers if appropriate. */
         CHECK_FOR_STRING_INDEX(id);
@@ -3436,18 +3673,16 @@ js_DefineProperty(JSContext *cx, JSObjec
             if (!(clasp)->addProperty(cx, obj, SPROP_USERID(sprop), vp)) {    \
                 cleanup;                                                      \
             }                                                                 \
             if (*(vp) != nominal_) {                                          \
                 if (SPROP_HAS_VALID_SLOT(sprop, scope))                       \
                     LOCKED_OBJ_WRITE_BARRIER(cx, obj, (sprop)->slot, *(vp));  \
             }                                                                 \
         }                                                                     \
-        if (STOBJ_IS_DELEGATE(obj) && JSID_IS_INT(sprop->id))                 \
-            cx->runtime->anyArrayProtoHasElement = JS_TRUE;                   \
     JS_END_MACRO
 
 JSBool
 js_DefineNativeProperty(JSContext *cx, JSObject *obj, jsid id, jsval value,
                         JSPropertyOp getter, JSPropertyOp setter, uintN attrs,
                         uintN flags, intN shortid, JSProperty **propp,
                         JSPropCacheEntry** entryp /* = NULL */)
 {
@@ -3505,17 +3740,17 @@ js_DefineNativeProperty(JSContext *cx, J
         }
     }
 #endif /* JS_HAS_GETTER_SETTER */
 
     /*
      * Purge the property cache of now-shadowed id in obj's scope chain.
      * Do this early, before locking obj to avoid nesting locks.
      */
-    PurgeScopeChain(cx, obj, id);
+    js_PurgeScopeChain(cx, obj, id);
 
     /* Lock if object locking is required by this implementation. */
     JS_LOCK_OBJ(cx, obj);
 
     /* Use the object's class getter and setter by default. */
     clasp = LOCKED_OBJ_GET_CLASS(obj);
     if (!getter)
         getter = clasp->getProperty;
@@ -3980,28 +4215,29 @@ js_GetCurrentBytecodePC(JSContext* cx)
      */
     return (*pc == JSOP_CALL && imacpc) ? imacpc : pc;
 }
 
 JSBool
 js_GetPropertyHelper(JSContext *cx, JSObject *obj, jsid id, jsval *vp,
                      JSPropCacheEntry **entryp)
 {
+    JSObject *aobj, *obj2;
     uint32 shape;
     int protoIndex;
-    JSObject *obj2;
     JSProperty *prop;
     JSScopeProperty *sprop;
 
     JS_ASSERT_IF(entryp, !JS_ON_TRACE(cx));
     /* Convert string indices to integers if appropriate. */
     CHECK_FOR_STRING_INDEX(id);
 
-    shape = OBJ_SHAPE(obj);
-    protoIndex = js_LookupPropertyWithFlags(cx, obj, id, cx->resolveFlags,
+    aobj = js_GetProtoIfDenseArray(cx, obj);
+    shape = OBJ_SHAPE(aobj);
+    protoIndex = js_LookupPropertyWithFlags(cx, aobj, id, cx->resolveFlags,
                                             &obj2, &prop);
     if (protoIndex < 0)
         return JS_FALSE;
     if (!prop) {
         *vp = JSVAL_VOID;
 
         if (!OBJ_GET_CLASS(cx, obj)->getProperty(cx, obj, ID_TO_VALUE(id), vp))
             return JS_FALSE;
@@ -4069,17 +4305,17 @@ js_GetPropertyHelper(JSContext *cx, JSOb
     }
 
     sprop = (JSScopeProperty *) prop;
     if (!js_NativeGet(cx, obj, obj2, sprop, vp))
         return JS_FALSE;
 
     if (entryp) {
         JS_ASSERT_NOT_ON_TRACE(cx);
-        js_FillPropertyCache(cx, obj, shape, 0, protoIndex, obj2, sprop, entryp);
+        js_FillPropertyCache(cx, aobj, shape, 0, protoIndex, obj2, sprop, entryp);
     }
     JS_UNLOCK_OBJ(cx, obj2);
     return JS_TRUE;
 }
 
 JSBool
 js_GetProperty(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
 {
@@ -4236,17 +4472,17 @@ js_SetPropertyHelper(JSContext *cx, JSOb
 #endif
     }
 
     if (!sprop) {
         /*
          * Purge the property cache of now-shadowed id in obj's scope chain.
          * Do this early, before locking obj to avoid nesting locks.
          */
-        PurgeScopeChain(cx, obj, id);
+        js_PurgeScopeChain(cx, obj, id);
 
         /* Find or make a property descriptor with the right heritage. */
         JS_LOCK_OBJ(cx, obj);
         scope = js_GetMutableScope(cx, obj);
         if (!scope) {
             JS_UNLOCK_OBJ(cx, obj);
             return JS_FALSE;
         }
@@ -5587,16 +5823,17 @@ js_SetRequiredSlot(JSContext *cx, JSObje
         }
     }
 
     /* Whether or not we grew nslots, we may need to advance freeslot. */
     if (scope->object == obj && slot >= scope->map.freeslot)
         scope->map.freeslot = slot + 1;
 
     STOBJ_SET_SLOT(obj, slot, v);
+    GC_POKE(cx, JS_NULL);
     JS_UNLOCK_SCOPE(cx, scope);
     return JS_TRUE;
 }
 
 JSObject *
 js_GetWrappedObject(JSContext *cx, JSObject *obj)
 {
     JSClass *clasp;

--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -433,16 +433,23 @@ extern JSObject *
 js_InitBlockClass(JSContext *cx, JSObject* obj);
 
 extern JSObject *
 js_InitEval(JSContext *cx, JSObject *obj);
 
 extern JSObject *
 js_InitObjectClass(JSContext *cx, JSObject *obj);
 
+extern JSObject *
+js_InitClass(JSContext *cx, JSObject *obj, JSObject *parent_proto,
+             JSClass *clasp, JSNative constructor, uintN nargs,
+             JSPropertySpec *ps, JSFunctionSpec *fs,
+             JSPropertySpec *static_ps, JSFunctionSpec *static_fs,
+             JSTraceableNative *trcinfo);
+
 /*
  * Select Object.prototype method names shared between jsapi.cpp and jsobj.cpp.
  */
 extern const char js_watch_str[];
 extern const char js_unwatch_str[];
 extern const char js_hasOwnProperty_str[];
 extern const char js_isPrototypeOf_str[];
 extern const char js_propertyIsEnumerable_str[];
@@ -481,16 +488,29 @@ js_NewObject(JSContext *cx, JSClass *cla
  * objectSize is either the explicit size for the allocated object or 0
  * indicating to use the default size based on object's class.
  */
 extern JSObject *
 js_NewObjectWithGivenProto(JSContext *cx, JSClass *clasp, JSObject *proto,
                            JSObject *parent, uintN objectSize);
 
 /*
+ * Allocate a new native object and initialize all fslots with JSVAL_VOID
+ * starting with the specified slot. The parent slot is set to the value of
+ * proto's parent slot.
+ *
+ * Note that this is the correct global object for native class instances, but
+ * not for user-defined functions called as constructors.  Functions used as
+ * constructors must create instances parented by the parent of the function
+ * object, not by the parent of its .prototype object value.
+ */
+extern JSObject*
+js_NewNativeObject(JSContext *cx, JSClass *clasp, JSObject *proto, uint32 slot);
+
+/*
  * Fast access to immutable standard objects (constructors and prototypes).
  */
 extern JSBool
 js_GetClassObject(JSContext *cx, JSObject *obj, JSProtoKey key,
                   JSObject **objp);
 
 extern JSBool
 js_SetClassObject(JSContext *cx, JSObject *obj, JSProtoKey key, JSObject *cobj);
@@ -536,16 +556,32 @@ js_FreeSlot(JSContext *cx, JSObject *obj
         }                                                                     \
     JS_END_MACRO
 
 extern jsid
 js_CheckForStringIndex(jsid id, const jschar *cp, const jschar *end,
                        JSBool negative);
 
 /*
+ * js_PurgeScopeChain does nothing if obj is not itself a prototype or parent
+ * scope, else it reshapes the scope and prototype chains it links. It calls
+ * js_PurgeScopeChainHelper, which asserts that obj is flagged as a delegate
+ * (i.e., obj has ever been on a prototype or parent chain).
+ */
+extern void
+js_PurgeScopeChainHelper(JSContext *cx, JSObject *obj, jsid id);
+
+static JS_INLINE void
+js_PurgeScopeChain(JSContext *cx, JSObject *obj, jsid id)
+{
+    if (OBJ_IS_DELEGATE(cx, obj))
+        js_PurgeScopeChainHelper(cx, obj, id);
+}
+
+/*
  * Find or create a property named by id in obj's scope, with the given getter
  * and setter, slot, attributes, and other members.
  */
 extern JSScopeProperty *
 js_AddNativeProperty(JSContext *cx, JSObject *obj, jsid id,
                      JSPropertyOp getter, JSPropertyOp setter, uint32 slot,
                      uintN attrs, uintN flags, intN shortid);
 

--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -70,16 +70,21 @@
 #include "jsscope.h"
 #include "jsscript.h"
 #include "jsstr.h"
 #include "jsstaticcheck.h"
 #include "jstracer.h"
 
 #include "jsautooplen.h"
 
+/*
+ * Index limit must stay within 32 bits.
+ */
+JS_STATIC_ASSERT(sizeof(uint32) * JS_BITS_PER_BYTE >= INDEX_LIMIT_LOG2 + 1);
+
 /* Verify JSOP_XXX_LENGTH constant definitions. */
 #define OPDEF(op,val,name,token,length,nuses,ndefs,prec,format)               \
     JS_STATIC_ASSERT(op##_LENGTH == length);
 #include "jsopcode.tbl"
 #undef OPDEF
 
 static const char js_incop_strs[][3] = {"++", "--"};
 static const char js_for_each_str[]  = "for each";

--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@@ -220,18 +220,16 @@ typedef enum JSOp {
                                  (pc)[2] = (jsbytecode)((uint32)(i) >> 16),   \
                                  (pc)[3] = (jsbytecode)((uint32)(i) >> 8),    \
                                  (pc)[4] = (jsbytecode)(uint32)(i))
 
 /* Index limit is determined by SN_3BYTE_OFFSET_FLAG, see jsemit.h. */
 #define INDEX_LIMIT_LOG2        23
 #define INDEX_LIMIT             ((uint32)1 << INDEX_LIMIT_LOG2)
 
-JS_STATIC_ASSERT(sizeof(uint32) * JS_BITS_PER_BYTE >= INDEX_LIMIT_LOG2 + 1);
-
 /* Actual argument count operand format helpers. */
 #define ARGC_HI(argc)           UINT16_HI(argc)
 #define ARGC_LO(argc)           UINT16_LO(argc)
 #define GET_ARGC(pc)            GET_UINT16(pc)
 #define ARGC_LIMIT              UINT16_LIMIT
 
 /* Synonyms for quick JOF_QARG and JOF_LOCAL bytecodes. */
 #define GET_ARGNO(pc)           GET_UINT16(pc)

--- a/js/src/jsprvtd.h
+++ b/js/src/jsprvtd.h
@@ -256,24 +256,9 @@ struct JSTempValueRooter {
  * treat char[] as utf-8 or simply as bytes that need to be inflated/deflated.
  */
 #ifdef JS_C_STRINGS_ARE_UTF8
 # define js_CStringsAreUTF8 JS_TRUE
 #else
 extern JSBool js_CStringsAreUTF8;
 #endif
 
-/*
- * Helper macros to convert between function and data pointers assuming that
- * they have the same size.
- */
-JS_STATIC_ASSERT(sizeof(void *) == sizeof(void (*)()));
-
-#ifdef __GNUC__
-# define JS_FUNC_TO_DATA_PTR(type, fun) (__extension__ (type) (fun))
-# define JS_DATA_TO_FUNC_PTR(type, ptr) (__extension__ (type) (ptr))
-#else
-/* Use an extra (void *) cast for MSVC. */
-# define JS_FUNC_TO_DATA_PTR(type, fun) ((type) (void *) (fun))
-# define JS_DATA_TO_FUNC_PTR(type, ptr) ((type) (void *) (ptr))
-#endif
-
 #endif /* jsprvtd_h___ */

--- a/js/src/jsregexp.cpp
+++ b/js/src/jsregexp.cpp
@@ -2144,17 +2144,17 @@ class RegExpNativeCompiler {
             mask.c[1] = mask2 ? 0x0020 : 0x0;
 
             if (mask.i) {
                 word |= mask.i;
                 useFastCI = JS_TRUE;
             }
         }
 
-        LIns* to_fail = lir->insBranch(LIR_jf, lir->ins2(LIR_lt, pos, cpend), 0);
+        LIns* to_fail = lir->insBranch(LIR_jf, lir->ins2(LIR_lt, pos, lir->ins2(LIR_sub, cpend, lir->insImm(2))), 0);
         fails.add(to_fail);
         LIns* text_word = lir->insLoad(LIR_ld, pos, lir->insImm(0));
         LIns* comp_word = useFastCI ?
             lir->ins2(LIR_or, text_word, lir->insImm(mask.i)) :
             text_word;
         fails.add(lir->insBranch(LIR_jf, lir->ins2(LIR_eq, comp_word, lir->insImm(word)), 0));
 
         return lir->ins2(LIR_piadd, pos, lir->insImm(4));
@@ -4945,45 +4945,90 @@ RegExp(JSContext *cx, JSObject *obj, uin
          * regexp_compile_sub does not use rval to root its temporaries so we
          * can use it to root obj.
          */
         *rval = OBJECT_TO_JSVAL(obj);
     }
     return regexp_compile_sub(cx, obj, argc, argv, rval);
 }
 
+#ifdef JS_TRACER
+
+static JSObject* FASTCALL
+RegExp_tn1(JSContext *cx, JSObject *proto, JSString *str)
+{
+    JSObject* obj = js_NewNativeObject(cx, &js_RegExpClass, proto, JSSLOT_PRIVATE);
+    if (!obj)
+        return NULL;
+
+    jsval argv[] = { JSVAL_NULL, OBJECT_TO_JSVAL(obj), STRING_TO_JSVAL(str) };
+    jsval rval;
+
+    if (!regexp_compile_sub(cx, obj, 1, argv + 2, &rval))
+        return NULL;
+
+    JS_ASSERT(JSVAL_IS_OBJECT(rval));
+    return JSVAL_TO_OBJECT(rval);
+}
+
+static JSObject* FASTCALL
+RegExp_tn2(JSContext *cx, JSObject *proto, JSString *str, JSString *opt)
+{
+    JSObject* obj = js_NewNativeObject(cx, &js_RegExpClass, proto, JSSLOT_PRIVATE);
+    if (!obj)
+        return NULL;
+
+    jsval argv[] = { JSVAL_NULL, OBJECT_TO_JSVAL(obj), STRING_TO_JSVAL(str), STRING_TO_JSVAL(opt) };
+    jsval rval;
+
+    if (!regexp_compile_sub(cx, obj, 2, argv + 2, &rval))
+        return NULL;
+
+    JS_ASSERT(JSVAL_IS_OBJECT(rval));
+    return JSVAL_TO_OBJECT(rval);
+}
+
+JS_DEFINE_TRCINFO_2(RegExp,
+    (3, (extern, CONSTRUCTOR_RETRY, RegExp_tn1, CONTEXT, CALLEE_PROTOTYPE, STRING,         0, 0)),
+    (4, (extern, CONSTRUCTOR_RETRY, RegExp_tn2, CONTEXT, CALLEE_PROTOTYPE, STRING, STRING, 0, 0)))
+
+#else  /* !JS_TRACER */
+
+# define RegExp_trcinfo NULL
+
+#endif /* !JS_TRACER */
+
 JSObject *
 js_InitRegExpClass(JSContext *cx, JSObject *obj)
 {
-    JSObject *proto, *ctor;
+    JSObject *proto = js_InitClass(cx, obj, NULL, &js_RegExpClass, RegExp, 1,
+                                   regexp_props, regexp_methods,
+                                   regexp_static_props, NULL,
+                                   RegExp_trcinfo);
+
+    if (!proto)
+        return NULL;
+
+    JSObject *ctor = JS_GetConstructor(cx, proto);
+    if (!ctor)
+        return NULL;
+
+    /* Give RegExp.prototype private data so it matches the empty string. */
     jsval rval;
-
-    proto = JS_InitClass(cx, obj, NULL, &js_RegExpClass, RegExp, 1,
-                         regexp_props, regexp_methods,
-                         regexp_static_props, NULL);
-
-    if (!proto || !(ctor = JS_GetConstructor(cx, proto)))
-        return NULL;
     if (!JS_AliasProperty(cx, ctor, "input",        "$_") ||
         !JS_AliasProperty(cx, ctor, "multiline",    "$*") ||
         !JS_AliasProperty(cx, ctor, "lastMatch",    "$&") ||
         !JS_AliasProperty(cx, ctor, "lastParen",    "$+") ||
         !JS_AliasProperty(cx, ctor, "leftContext",  "$`") ||
-        !JS_AliasProperty(cx, ctor, "rightContext", "$'")) {
-        goto bad;
+        !JS_AliasProperty(cx, ctor, "rightContext", "$'") ||
+        !regexp_compile_sub(cx, proto, 0, NULL, &rval)) {
+        return NULL;
     }
 
-    /* Give RegExp.prototype private data so it matches the empty string. */
-    if (!regexp_compile_sub(cx, proto, 0, NULL, &rval))
-        goto bad;
     return proto;
-
-bad:
-    JS_DeleteProperty(cx, obj, js_RegExpClass.name);
-    return NULL;
 }
 
 JSObject *
 js_NewRegExpObject(JSContext *cx, JSTokenStream *ts,
                    jschar *chars, size_t length, uintN flags)
 {
     JSString *str;
     JSObject *obj;

--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -52,16 +52,17 @@
 #include "jsapi.h"
 #include "jsatom.h"
 #include "jscntxt.h"
 #include "jsdbgapi.h"
 #include "jslock.h"
 #include "jsnum.h"
 #include "jsscope.h"
 #include "jsstr.h"
+#include "jsarray.h"
 
 JSScope *
 js_GetMutableScope(JSContext *cx, JSObject *obj)
 {
     JSScope *scope, *newscope;
     JSClass *clasp;
     uint32 freeslot;
 
@@ -1299,16 +1300,20 @@ js_AddScopeProperty(JSContext *cx, JSSco
          * this little set-back.  Therefore we must test !scope->table and
          * scope->entryCount >= SCOPE_HASH_THRESHOLD, not merely whether the
          * entry count just reached the threshold.
          */
         if (!scope->table && scope->entryCount >= SCOPE_HASH_THRESHOLD)
             (void) CreateScopeTable(cx, scope, JS_FALSE);
     }
 
+    jsuint index;
+    if (js_IdIsIndex(sprop->id, &index))
+        SCOPE_SET_INDEXED_PROPERTIES(scope);
+
     METER(adds);
     return sprop;
 
 fail_overwrite:
     if (overwriting) {
         /*
          * We may or may not have forked overwriting out of scope's ancestor
          * line, so we must check (the alternative is to set a flag above, but

--- a/js/src/jsscope.h
+++ b/js/src/jsscope.h
@@ -206,20 +206,16 @@ struct JSScope {
     int8            hashShift;          /* multiplicative hash shift */
     uint16          spare;              /* reserved */
     uint32          entryCount;         /* number of entries in table */
     uint32          removedCount;       /* removed entry sentinels in table */
     JSScopeProperty **table;            /* table of ptrs to shared tree nodes */
     JSScopeProperty *lastProp;          /* pointer to last property added */
 };
 
-#ifdef JS_THREADSAFE
-JS_STATIC_ASSERT(offsetof(JSScope, title) == sizeof(JSObjectMap));
-#endif
-
 #define JS_IS_SCOPE_LOCKED(cx, scope)   JS_IS_TITLE_LOCKED(cx, &(scope)->title)
 
 #define OBJ_SCOPE(obj)                  ((JSScope *)(obj)->map)
 #define OBJ_SHAPE(obj)                  (OBJ_SCOPE(obj)->shape)
 
 #define SCOPE_MAKE_UNIQUE_SHAPE(cx,scope)                                     \
     ((scope)->shape = js_GenerateShape((cx), JS_FALSE, NULL))
 
@@ -235,20 +231,23 @@ JS_STATIC_ASSERT(offsetof(JSScope, title
 
 /* By definition, hashShift = JS_DHASH_BITS - log2(capacity). */
 #define SCOPE_CAPACITY(scope)           JS_BIT(JS_DHASH_BITS-(scope)->hashShift)
 
 /* Scope flags and some macros to hide them from other files than jsscope.c. */
 #define SCOPE_MIDDLE_DELETE             0x0001
 #define SCOPE_SEALED                    0x0002
 #define SCOPE_BRANDED                   0x0004
+#define SCOPE_INDEXED_PROPERTIES        0x0008
 
 #define SCOPE_HAD_MIDDLE_DELETE(scope)  ((scope)->flags & SCOPE_MIDDLE_DELETE)
 #define SCOPE_SET_MIDDLE_DELETE(scope)  ((scope)->flags |= SCOPE_MIDDLE_DELETE)
 #define SCOPE_CLR_MIDDLE_DELETE(scope)  ((scope)->flags &= ~SCOPE_MIDDLE_DELETE)
+#define SCOPE_HAS_INDEXED_PROPERTIES(scope)  ((scope)->flags & SCOPE_INDEXED_PROPERTIES)
+#define SCOPE_SET_INDEXED_PROPERTIES(scope)  ((scope)->flags |= SCOPE_INDEXED_PROPERTIES)
 
 #define SCOPE_IS_SEALED(scope)          ((scope)->flags & SCOPE_SEALED)
 #define SCOPE_SET_SEALED(scope)         ((scope)->flags |= SCOPE_SEALED)
 #if 0
 /*
  * Don't define this, it can't be done safely because JS_LOCK_OBJ will avoid
  * taking the lock if the object owns its scope and the scope is sealed.
  */

--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -2551,17 +2551,17 @@ JS_DEFINE_TRCINFO_4(str_concat,
 JS_DEFINE_TRCINFO_2(str_match,
     (4, (static, JSVAL_FAIL,        String_p_match, CONTEXT, THIS_STRING, PC, REGEXP,         1, 1)),
     (4, (static, JSVAL_FAIL,        String_p_match_obj, CONTEXT, THIS, PC, REGEXP,            1, 1)))
 JS_DEFINE_TRCINFO_3(str_replace,
     (4, (static, STRING_RETRY,      String_p_replace_str, CONTEXT, THIS_STRING, REGEXP, STRING, 1, 1)),
     (4, (static, STRING_RETRY,      String_p_replace_str2, CONTEXT, THIS_STRING, STRING, STRING, 1, 1)),
     (5, (static, STRING_RETRY,      String_p_replace_str3, CONTEXT, THIS_STRING, STRING, STRING, STRING, 1, 1)))
 JS_DEFINE_TRCINFO_1(str_split,
-    (3, (static, OBJECT_RETRY_NULL, String_p_split, CONTEXT, THIS_STRING, STRING,             0, 0)))
+    (3, (static, OBJECT_RETRY,      String_p_split, CONTEXT, THIS_STRING, STRING,             0, 0)))
 JS_DEFINE_TRCINFO_1(str_toLowerCase,
     (2, (extern, STRING_RETRY,      js_toLowerCase, CONTEXT, THIS_STRING,                     1, 1)))
 JS_DEFINE_TRCINFO_1(str_toUpperCase,
     (2, (extern, STRING_RETRY,      js_toUpperCase, CONTEXT, THIS_STRING,                     1, 1)))
 
 #define GENERIC           JSFUN_GENERIC_NATIVE
 #define PRIMITIVE         JSFUN_THISP_PRIMITIVE
 #define GENERIC_PRIMITIVE (GENERIC | PRIMITIVE)

--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -92,17 +92,17 @@ static const char tagChar[]  = "OIDISIBI
 
 /* Blacklist parameters. */
 
 /* Number of iterations of a loop where we start tracing.  That is, we don't
    start tracing until the beginning of the HOTLOOP-th iteration. */
 #define HOTLOOP 2
 
 /* Attempt recording this many times before blacklisting permanently. */
-#define BL_ATTEMPTS 6
+#define BL_ATTEMPTS 2
 
 /* Skip this many future hits before allowing recording again after blacklisting. */
 #define BL_BACKOFF 32
 
 /* Number of times we wait to exit on a side exit before we try to extend the tree. */
 #define HOTEXIT 1
 
 /* Number of times we try to extend the tree along a side exit. */
@@ -236,16 +236,17 @@ js_DumpPeerStability(JSTraceMonitor* tm,
 /* We really need a better way to configure the JIT. Shaver, where is my fancy JIT object? */
 static bool nesting_enabled = true;
 #if defined(NANOJIT_IA32)
 static bool did_we_check_sse2 = false;
 #endif
 
 #ifdef JS_JIT_SPEW
 bool js_verboseDebug = getenv("TRACEMONKEY") && strstr(getenv("TRACEMONKEY"), "verbose");
+bool js_verboseStats = getenv("TRACEMONKEY") && strstr(getenv("TRACEMONKEY"), "stats");
 #endif
 
 /* The entire VM shares one oracle. Collisions and concurrent updates are tolerated and worst
    case cause performance regressions. */
 static Oracle oracle;
 
 Tracker::Tracker()
 {
@@ -469,23 +470,16 @@ js_Backoff(Fragment* tree, const jsbytec
     JS_ASSERT(tree->root == tree);
     if (++tree->recordAttempts > BL_ATTEMPTS) {
         js_Blacklist(tree);
         return;
     }
     tree->hits() -= BL_BACKOFF;
 }
 
-static void
-js_AttemptCompilation(Fragment* tree)
-{
-    --tree->recordAttempts;
-    tree->hits() = 0;
-}
-
 static inline size_t
 fragmentHash(const void *ip, uint32 globalShape)
 {
     uintptr_t h = HASH_SEED;
     hash_accum(h, uintptr_t(ip), FRAGMENT_TABLE_MASK);
     hash_accum(h, uintptr_t(globalShape), FRAGMENT_TABLE_MASK);
     return size_t(h);
 }
@@ -544,16 +538,35 @@ getAnchor(JSTraceMonitor* tm, const void
         tm->vmfragments[h] = f;
     }
     f->anchor = f;
     f->root = f;
     f->kind = LoopTrace;
     return f;
 }
 
+static void
+js_AttemptCompilation(JSTraceMonitor* tm, JSObject* globalObj, jsbytecode* pc)
+{
+    Fragment* f = getLoop(tm, pc, OBJ_SHAPE(globalObj));
+    JS_ASSERT(f->root == f);
+    /*
+     * Breath new live into all peer fragments at the designated loop header. If we already
+     * permanently blacklisted the location, undo that.
+     */
+    f = f->first;
+    while (f) {
+        JS_ASSERT(f->root == f);
+        JS_ASSERT(*(jsbytecode*)f->ip == JSOP_NOP || *(jsbytecode*)f->ip == JSOP_LOOP);
+        *(jsbytecode*)f->ip = JSOP_LOOP;
+        --f->recordAttempts;
+        f->hits() = HOTLOOP;
+        f = f->peer;
+    }
+}
 
 #if defined(NJ_SOFTFLOAT)
 JS_DEFINE_CALLINFO_1(static, DOUBLE,    i2f, INT32,                 1, 1)
 JS_DEFINE_CALLINFO_1(static, DOUBLE,    u2f, UINT32,                1, 1)
 #endif
 
 static bool isi2f(LInsp i)
 {
@@ -1178,17 +1191,17 @@ specializeTreesToMissingGlobals(JSContex
 }
 
 static void
 js_TrashTree(JSContext* cx, Fragment* f);
 
 JS_REQUIRES_STACK
 TraceRecorder::TraceRecorder(JSContext* cx, VMSideExit* _anchor, Fragment* _fragment,
         TreeInfo* ti, unsigned stackSlots, unsigned ngslots, uint8* typeMap,
-        VMSideExit* innermostNestedGuard, Fragment* outer)
+        VMSideExit* innermostNestedGuard, jsbytecode* outer)
 {
     JS_ASSERT(!_fragment->vmprivate && ti);
 
     this->cx = cx;
     this->traceMonitor = &JS_TRACE_MONITOR(cx);
     this->globalObj = JS_GetGlobalForObject(cx, cx->fp->scopeChain);
     this->anchor = _anchor;
     this->fragment = _fragment;
@@ -1807,16 +1820,37 @@ TraceRecorder::import(TreeInfo* treeInfo
     ptrdiff_t offset = -treeInfo->nativeStackBase;
     m = typeMap;
     FORALL_SLOTS_IN_PENDING_FRAMES(cx, callDepth,
         import(sp, offset, vp, *m, vpname, vpnum, fp);
         m++; offset += sizeof(double);
     );
 }
 
+JS_REQUIRES_STACK bool
+TraceRecorder::isValidSlot(JSScope* scope, JSScopeProperty* sprop)
+{
+    uint32 setflags = (js_CodeSpec[*cx->fp->regs->pc].format & (JOF_SET | JOF_INCDEC | JOF_FOR));
+
+    if (setflags) {
+        if (!SPROP_HAS_STUB_SETTER(sprop))
+            ABORT_TRACE("non-stub setter");
+        if (sprop->attrs & JSPROP_READONLY)
+            ABORT_TRACE("writing to a read-only property");
+    }
+    /* This check applies even when setflags == 0. */
+    if (setflags != JOF_SET && !SPROP_HAS_STUB_GETTER(sprop))
+        ABORT_TRACE("non-stub getter");
+
+    if (!SPROP_HAS_VALID_SLOT(sprop, scope))
+        ABORT_TRACE("slotless obj property");
+
+    return true;
+}
+
 /* Lazily import a global slot if we don't already have it in the tracker. */
 JS_REQUIRES_STACK bool
 TraceRecorder::lazilyImportGlobalSlot(unsigned slot)
 {
     if (slot != uint16(slot)) /* we use a table of 16-bit ints, bail out if that's not enough */
         return false;
     jsval* vp = &STOBJ_GET_SLOT(globalObj, slot);
     if (known(vp))
@@ -2452,31 +2486,31 @@ TraceRecorder::isLoopHeader(JSContext* c
 
 /* Compile the current fragment. */
 JS_REQUIRES_STACK void
 TraceRecorder::compile(JSTraceMonitor* tm)
 {
     Fragmento* fragmento = tm->fragmento;
     if (treeInfo->maxNativeStackSlots >= MAX_NATIVE_STACK_SLOTS) {
         debug_only_v(printf("Blacklist: excessive stack use.\n"));
-        js_Blacklist(fragment);
+        js_Blacklist(fragment->root);
         return;
     }
     if (anchor && anchor->exitType != CASE_EXIT)
         ++treeInfo->branchCount;
     if (lirbuf->outOMem()) {
         fragmento->assm()->setError(nanojit::OutOMem);
         return;
     }
     ::compile(fragmento->assm(), fragment);
     if (fragmento->assm()->error() == nanojit::OutOMem)
         return;
     if (fragmento->assm()->error() != nanojit::None) {
         debug_only_v(printf("Blacklisted: error during compilation\n");)
-        js_Blacklist(fragment);
+        js_Blacklist(fragment->root);
         return;
     }
     if (anchor) {
 #ifdef NANOJIT_IA32
         if (anchor->exitType == CASE_EXIT)
             fragmento->assm()->patch(anchor, anchor->switchInfo);
         else
 #endif
@@ -2530,17 +2564,17 @@ TraceRecorder::closeLoop(JSTraceMonitor*
     Fragment* peer_root;
     Fragmento* fragmento = tm->fragmento;
 
     exitIns = snapshot(UNSTABLE_LOOP_EXIT);
     exit = (VMSideExit*)((GuardRecord*)exitIns->payload())->exit;
 
     if (callDepth != 0) {
         debug_only_v(printf("Blacklisted: stack depth mismatch, possible recursion.\n");)
-        js_Blacklist(fragment);
+        js_Blacklist(fragment->root);
         trashSelf = true;
         return false;
     }
 
     JS_ASSERT(exit->numStackSlots == treeInfo->nStackTypes);
 
     peer_root = getLoop(traceMonitor, fragment->root->ip, treeInfo->globalShape);
     JS_ASSERT(peer_root != NULL);
@@ -2614,18 +2648,18 @@ TraceRecorder::closeLoop(JSTraceMonitor*
     debug_only_v(printf("updating specializations on dependent and linked trees\n"))
     if (fragment->root->vmprivate)
         specializeTreesToMissingGlobals(cx, (TreeInfo*)fragment->root->vmprivate);
 
     /* 
      * If this is a newly formed tree, and the outer tree has not been compiled yet, we
      * should try to compile the outer tree again.
      */
-    if (outer && fragment == fragment->root)
-        js_AttemptCompilation(outer);
+    if (outer)
+        js_AttemptCompilation(tm, globalObj, outer);
     
     debug_only_v(printf("recording completed at %s:%u@%u via closeLoop\n",
                         cx->fp->script->filename,
                         js_FramePCToLineNumber(cx, cx->fp),
                         FramePCOffset(cx->fp));)
     return true;
 }
 
@@ -2711,17 +2745,17 @@ TraceRecorder::joinEdgesToEntry(Fragment
 /* Emit an always-exit guard and compile the tree (used for break statements. */
 JS_REQUIRES_STACK void
 TraceRecorder::endLoop(JSTraceMonitor* tm)
 {
     LIns* exitIns = snapshot(LOOP_EXIT);
 
     if (callDepth != 0) {
         debug_only_v(printf("Blacklisted: stack depth mismatch, possible recursion.\n");)
-        js_Blacklist(fragment);
+        js_Blacklist(fragment->root);
         trashSelf = true;
         return;
     }
 
     fragment->lastIns = lir->insGuard(LIR_x, lir->insImm(1), exitIns);
     compile(tm);
 
     if (tm->fragmento->assm()->error() != nanojit::None)
@@ -2734,18 +2768,18 @@ TraceRecorder::endLoop(JSTraceMonitor* t
     debug_only_v(printf("updating specializations on dependent and linked trees\n"))
     if (fragment->root->vmprivate)
         specializeTreesToMissingGlobals(cx, (TreeInfo*)fragment->root->vmprivate);
 
     /* 
      * If this is a newly formed tree, and the outer tree has not been compiled yet, we
      * should try to compile the outer tree again.
      */
-    if (outer && fragment == fragment->root)
-        js_AttemptCompilation(outer);
+    if (outer)
+        js_AttemptCompilation(tm, globalObj, outer);
     
     debug_only_v(printf("recording completed at %s:%u@%u via endLoop\n",
                         cx->fp->script->filename,
                         js_FramePCToLineNumber(cx, cx->fp),
                         FramePCOffset(cx->fp));)
 }
 
 /* Emit code to adjust the stack to match the inner tree's stack expectations. */
@@ -2996,28 +3030,27 @@ js_CheckGlobalObjectShape(JSContext* cx,
 
     if (tm->recorder) {
         TreeInfo* ti = tm->recorder->getTreeInfo();
         /* Check the global shape matches the recorder's treeinfo's shape. */
         if (globalShape != ti->globalShape) {
             AUDIT(globalShapeMismatchAtEntry);
             debug_only_v(printf("Global shape mismatch (%u vs. %u), flushing cache.\n",
                                 globalShape, ti->globalShape);)
-                return false;
+            return false;
         }
         if (shape)
             *shape = globalShape;
         if (slots)
             *slots = ti->globalSlots;
         return true;
     }
 
     /* No recorder, search for a tracked global-state (or allocate one). */
     for (size_t i = 0; i < MONITOR_N_GLOBAL_STATES; ++i) {
-
         GlobalState &state = tm->globalStates[i];
 
         if (state.globalShape == (uint32) -1) {
             state.globalShape = globalShape;
             JS_ASSERT(state.globalSlots);
             JS_ASSERT(state.globalSlots->length() == 0);
         }
 
@@ -3035,17 +3068,17 @@ js_CheckGlobalObjectShape(JSContext* cx,
     debug_only_v(printf("No global slotlist for global shape %u, flushing cache.\n",
                         globalShape));
     return false;
 }
 
 static JS_REQUIRES_STACK bool
 js_StartRecorder(JSContext* cx, VMSideExit* anchor, Fragment* f, TreeInfo* ti,
                  unsigned stackSlots, unsigned ngslots, uint8* typeMap,
-                 VMSideExit* expectedInnerExit, Fragment* outer)
+                 VMSideExit* expectedInnerExit, jsbytecode* outer)
 {
     JSTraceMonitor* tm = &JS_TRACE_MONITOR(cx);
     JS_ASSERT(f->root != f || !cx->fp->imacpc);
 
     if (JS_TRACE_MONITOR(cx).prohibitRecording)
         return false;
 
     /* start recording if no exception during construction */
@@ -3261,17 +3294,17 @@ js_SynthesizeFrame(JSContext* cx, const 
     // callee's, including missing arguments. Could we shift everything down to the caller's
     // fp->slots (where vars start) and avoid some of the complexity?
     return (fi.s.spdist - fp->down->script->nfixed) +
            ((fun->nargs > fp->argc) ? fun->nargs - fp->argc : 0) +
            script->nfixed;
 }
 
 JS_REQUIRES_STACK bool
-js_RecordTree(JSContext* cx, JSTraceMonitor* tm, Fragment* f, Fragment* outer,
+js_RecordTree(JSContext* cx, JSTraceMonitor* tm, Fragment* f, jsbytecode* outer,
               uint32 globalShape, SlotList* globalSlots)
 {
     JS_ASSERT(f->root == f);
 
     /* Make sure the global type map didn't change on us. */
     JSObject* globalObj = JS_GetGlobalForObject(cx, cx->fp->scopeChain);
     if (!js_CheckGlobalObjectShape(cx, tm, globalObj)) {
         js_FlushJITCache(cx);
@@ -3351,17 +3384,17 @@ isSlotUndemotable(JSContext* cx, TreeInf
     if (slot < ti->nStackTypes)
         return oracle.isStackSlotUndemotable(cx, slot);
 
     uint16* gslots = ti->globalSlots->data();
     return oracle.isGlobalSlotUndemotable(cx, gslots[slot - ti->nStackTypes]);
 }
 
 JS_REQUIRES_STACK static bool
-js_AttemptToStabilizeTree(JSContext* cx, VMSideExit* exit, Fragment* outer)
+js_AttemptToStabilizeTree(JSContext* cx, VMSideExit* exit, jsbytecode* outer)
 {
     JSTraceMonitor* tm = &JS_TRACE_MONITOR(cx);
     Fragment* from = exit->from->root;
     TreeInfo* from_ti = (TreeInfo*)from->vmprivate;
 
     JS_ASSERT(exit->from->root->code());
 
     /* Make sure any doubles are not accidentally undemoted */
@@ -3448,17 +3481,17 @@ js_AttemptToStabilizeTree(JSContext* cx,
     }
     if (bound)
         return false;
 
     return js_RecordTree(cx, tm, from->first, outer, from_ti->globalShape, from_ti->globalSlots);
 }
 
 static JS_REQUIRES_STACK bool
-js_AttemptToExtendTree(JSContext* cx, VMSideExit* anchor, VMSideExit* exitedFrom, Fragment* outer)
+js_AttemptToExtendTree(JSContext* cx, VMSideExit* anchor, VMSideExit* exitedFrom, jsbytecode* outer)
 {
     Fragment* f = anchor->from->root;
     JS_ASSERT(f->vmprivate);
     TreeInfo* ti = (TreeInfo*)f->vmprivate;
 
     /* Don't grow trees above a certain size to avoid code explosion due to tail duplication. */
     if (ti->branchCount >= MAX_BRANCHES)
         return false;
@@ -3470,17 +3503,17 @@ js_AttemptToExtendTree(JSContext* cx, VM
         c->parent = f;
         anchor->target = c;
         c->root = f;
     }
 
     debug_only_v(printf("trying to attach another branch to the tree (hits = %d)\n", c->hits());)
 
     int32_t& hits = c->hits();
-    if (hits++ >= HOTEXIT && hits <= HOTEXIT+MAXEXIT) {
+    if (outer || hits++ >= HOTEXIT && hits <= HOTEXIT+MAXEXIT) {
         /* start tracing secondary trace from this point */
         c->lirbuf = f->lirbuf;
         unsigned stackSlots;
         unsigned ngslots;
         uint8* typeMap;
         TypeMap fullMap;
         if (exitedFrom == NULL) {
             /* If we are coming straight from a simple side exit, just use that exit's type map
@@ -3566,16 +3599,23 @@ js_RecordLoopEdge(JSContext* cx, TraceRe
     }
     /* If we hit our own loop header, close the loop and compile the trace. */
     if (r->isLoopHeader(cx))
         return js_CloseLoop(cx);
     /* does this branch go to an inner loop? */
     Fragment* f = getLoop(&JS_TRACE_MONITOR(cx), cx->fp->regs->pc, ti->globalShape);
     if (nesting_enabled && f) {
 
+        /* Cannot handle treecalls with callDepth > 0 and argc > nargs, see bug 480244. */
+        if (r->getCallDepth() > 0 && 
+            cx->fp->argc > cx->fp->fun->nargs) {
+            js_AbortRecording(cx, "Can't call inner tree with extra args in pending frame");
+            return false;
+        }
+
         /* Make sure inner tree call will not run into an out-of-memory condition. */
         if (tm->reservedDoublePoolPtr < (tm->reservedDoublePool + MAX_NATIVE_STACK_SLOTS) &&
             !js_ReplenishReservedPool(cx, tm)) {
             js_AbortRecording(cx, "Couldn't call inner tree (out of memory)");
             return false;
         }
 
         /* Make sure the shape of the global object still matches (this might flush
@@ -3598,63 +3638,59 @@ js_RecordLoopEdge(JSContext* cx, TraceRe
         bool success = false;
 
         f = r->findNestedCompatiblePeer(f, &empty);
         if (f && f->code())
             success = r->adjustCallerTypes(f);
 
         if (!success) {
             AUDIT(noCompatInnerTrees);
-            debug_only_v(printf("No compatible inner tree (%p).\n", (void*)f);)
-
-            Fragment* old = getLoop(tm, tm->recorder->getFragment()->root->ip, ti->globalShape);
-            if (old == NULL)
-                old = tm->recorder->getFragment();
+
+            jsbytecode* outer = (jsbytecode*)tm->recorder->getFragment()->root->ip;
             js_AbortRecording(cx, "No compatible inner tree");
 
             f = empty;
             if (!f) {
                 f = getAnchor(tm, cx->fp->regs->pc, globalShape);
                 if (!f) {
                     js_FlushJITCache(cx);
                     return false;
                 }
             }
-            return js_RecordTree(cx, tm, f, old, globalShape, globalSlots);
+            return js_RecordTree(cx, tm, f, outer, globalShape, globalSlots);
         }
 
         r->prepareTreeCall(f);
         VMSideExit* innermostNestedGuard = NULL;
         VMSideExit* lr = js_ExecuteTree(cx, f, inlineCallCount, &innermostNestedGuard);
         if (!lr || r->wasDeepAborted()) {
             if (!lr)
                 js_AbortRecording(cx, "Couldn't call inner tree");
             return false;
         }
-        Fragment* old;
+        jsbytecode* outer = (jsbytecode*)tm->recorder->getFragment()->root->ip;
         switch (lr->exitType) {
           case LOOP_EXIT:
             /* If the inner tree exited on an unknown loop exit, grow the tree around it. */
             if (innermostNestedGuard) {
-                js_AbortRecording(cx, "Inner tree took different side exit, abort recording");
-                return js_AttemptToExtendTree(cx, innermostNestedGuard, lr, NULL);
+                js_AbortRecording(cx, "Inner tree took different side exit, abort current "
+                                      "recording and grow nesting tree");
+                return js_AttemptToExtendTree(cx, innermostNestedGuard, lr, outer);
             }
             /* emit a call to the inner tree and continue recording the outer tree trace */
             r->emitTreeCall(f, lr);
             return true;
         case UNSTABLE_LOOP_EXIT:
             /* abort recording so the inner loop can become type stable. */
-            old = getLoop(tm, tm->recorder->getFragment()->root->ip, ti->globalShape);
             js_AbortRecording(cx, "Inner tree is trying to stabilize, abort outer recording");
-            return js_AttemptToStabilizeTree(cx, lr, old);
+            return js_AttemptToStabilizeTree(cx, lr, outer);
         case BRANCH_EXIT:
             /* abort recording the outer tree, extend the inner tree */
-            old = getLoop(tm, tm->recorder->getFragment()->root->ip, ti->globalShape);
             js_AbortRecording(cx, "Inner tree is trying to grow, abort outer recording");
-            return js_AttemptToExtendTree(cx, lr, NULL, old);
+            return js_AttemptToExtendTree(cx, lr, NULL, outer);
         default:
             debug_only_v(printf("exit_type=%d\n", lr->exitType);)
             js_AbortRecording(cx, "Inner tree not suitable for calling");
             return false;
         }
     }
 
     /* not returning to our own loop header, not an inner loop we can call, abort trace */
@@ -4257,17 +4293,17 @@ js_MonitorLoopEdge(JSContext* cx, uintN&
     uintN count;
     Fragment* match = js_FindVMCompatiblePeer(cx, f, count);
     if (!match) {
         if (count < MAXPEERS)
             goto record;
         /* If we hit the max peers ceiling, don't try to lookup fragments all the time. Thats
            expensive. This must be a rather type-unstable loop. */
         debug_only_v(printf("Blacklisted: too many peer trees.\n");)
-        js_Blacklist(f);
+        js_Blacklist(f->root);
         return false;
     }
 
     VMSideExit* lr = NULL;
     VMSideExit* innermostNestedGuard = NULL;
 
     lr = js_ExecuteTree(cx, match, inlineCallCount, &innermostNestedGuard);
     if (!lr)
@@ -4475,17 +4511,17 @@ js_CheckForSSE2()
         : /* We have no inputs */
         : "%eax", "%ecx"
        );
 #endif
     return (features & (1<<26)) != 0;
 }
 #endif
 
-extern void
+void
 js_InitJIT(JSTraceMonitor *tm)
 {
 #if defined NANOJIT_IA32
     if (!did_we_check_sse2) {
         avmplus::AvmCore::config.use_cmov =
         avmplus::AvmCore::config.sse2 = js_CheckForSSE2();
         did_we_check_sse2 = true;
     }
@@ -4513,21 +4549,21 @@ js_InitJIT(JSTraceMonitor *tm)
         tm->reFragmento = fragmento;
         tm->reLirBuf = new (&gc) LirBuffer(fragmento, NULL);
     }
 #if !defined XP_WIN
     debug_only(memset(&jitstats, 0, sizeof(jitstats)));
 #endif
 }
 
-extern void
+void
 js_FinishJIT(JSTraceMonitor *tm)
 {
 #ifdef JS_JIT_SPEW
-    if (jitstats.recorderStarted) {
+    if (js_verboseStats && jitstats.recorderStarted) {
         printf("recorder: started(%llu), aborted(%llu), completed(%llu), different header(%llu), "
                "trees trashed(%llu), slot promoted(%llu), unstable loop variable(%llu), "
                "breaks(%llu), returns(%llu), unstableInnerCalls(%llu)\n",
                jitstats.recorderStarted, jitstats.recorderAborted, jitstats.traceCompleted,
                jitstats.returnToDifferentLoopHeader, jitstats.treesTrashed, jitstats.slotPromoted,
                jitstats.unstableLoopVariable, jitstats.breakLoopExits, jitstats.returnLoopExits,
                jitstats.noCompatInnerTrees);
         printf("monitor: triggered(%llu), exits(%llu), type mismatch(%llu), "
@@ -4586,25 +4622,25 @@ TraceRecorder::popAbortStack()
     JSTraceMonitor* tm = &JS_TRACE_MONITOR(cx);
 
     JS_ASSERT(tm->abortStack == this);
 
     tm->abortStack = nextRecorderToAbort;
     nextRecorderToAbort = NULL;
 }
 
-extern void
+void
 js_FlushJITOracle(JSContext* cx)
 {
     if (!TRACING_ENABLED(cx))
         return;
     oracle.clear();
 }
 
-extern JS_REQUIRES_STACK void
+JS_REQUIRES_STACK void
 js_FlushScriptFragments(JSContext* cx, JSScript* script)
 {
     if (!TRACING_ENABLED(cx))
         return;
     debug_only_v(printf("Flushing fragments for JSScript %p.\n", (void*)script);)
     JSTraceMonitor* tm = &JS_TRACE_MONITOR(cx);
     for (size_t i = 0; i < FRAGMENT_TABLE_SIZE; ++i) {
         for (VMFragment **f = &(tm->vmfragments[i]); *f; ) {
@@ -4620,17 +4656,17 @@ js_FlushScriptFragments(JSContext* cx, J
                 *f = next;
             } else {
                 f = &((*f)->next);
             }
         }
     }
 }
 
-extern JS_REQUIRES_STACK void
+JS_REQUIRES_STACK void
 js_FlushJITCache(JSContext* cx)
 {
     if (!TRACING_ENABLED(cx))
         return;
     debug_only_v(printf("Flushing cache.\n");)
     JSTraceMonitor* tm = &JS_TRACE_MONITOR(cx);
     if (tm->recorder)
         js_AbortRecording(cx, "flush cache");
@@ -4737,48 +4773,45 @@ TraceRecorder::activeCallOrGlobalSlot(JS
     JS_ASSERT(obj != globalObj);
 
     JSAtom* atom = atoms[GET_INDEX(cx->fp->regs->pc)];
     JSObject* obj2;
     JSProperty* prop;
     if (js_FindProperty(cx, ATOM_TO_JSID(atom), &obj, &obj2, &prop) < 0 || !prop)
         ABORT_TRACE("failed to find name in non-global scope chain");
 
-    uint32 setflags = (js_CodeSpec[*cx->fp->regs->pc].format & (JOF_SET | JOF_INCDEC | JOF_FOR));
-
     if (obj == globalObj) {
         JSScopeProperty* sprop = (JSScopeProperty*) prop;
 
-        if (setflags && (sprop->attrs & JSPROP_READONLY))
-            ABORT_TRACE("writing to a readonly property");
-
-        if (obj2 != obj || !SPROP_HAS_VALID_SLOT(sprop, OBJ_SCOPE(obj))) {
+        if (obj2 != obj) {
+            OBJ_DROP_PROPERTY(cx, obj2, prop);
+            ABORT_TRACE("prototype property");
+        }
+        if (!isValidSlot(OBJ_SCOPE(obj), sprop)) {
             OBJ_DROP_PROPERTY(cx, obj2, prop);
-            ABORT_TRACE("prototype or slotless globalObj property");
+            return false;
         }
-
-        if (!lazilyImportGlobalSlot(sprop->slot))
-             ABORT_TRACE("lazy import of global slot failed");
+        if (!lazilyImportGlobalSlot(sprop->slot)) {
+            OBJ_DROP_PROPERTY(cx, obj2, prop);
+            ABORT_TRACE("lazy import of global slot failed");
+        }
         vp = &STOBJ_GET_SLOT(obj, sprop->slot);
         OBJ_DROP_PROPERTY(cx, obj2, prop);
         return true;
     }
 
     if (wasDeepAborted())
         ABORT_TRACE("deep abort from property lookup");
 
     if (obj == obj2 && OBJ_GET_CLASS(cx, obj) == &js_CallClass) {
         JSStackFrame* cfp = (JSStackFrame*) JS_GetPrivate(cx, obj);
         if (cfp && FrameInRange(cx->fp, cfp, callDepth)) {
             JSScopeProperty* sprop = (JSScopeProperty*) prop;
             uintN slot = sprop->shortid;
 
-            if (setflags && (sprop->attrs & JSPROP_READONLY))
-                ABORT_TRACE("writing to a readonly property");
-
             vp = NULL;
             if (sprop->getter == js_GetCallArg) {
                 JS_ASSERT(slot < cfp->fun->nargs);
                 vp = &cfp->argv[slot];
             } else if (sprop->getter == js_GetCallVar) {
                 JS_ASSERT(slot < cfp->script->nslots);
                 vp = &cfp->slots[slot];
             }
@@ -5770,25 +5803,19 @@ TraceRecorder::test_property_cache_direc
     /* Insist on obj being the directly addressed object. */
     if (obj2 != obj)
         ABORT_TRACE("test_property_cache_direct_slot hit prototype chain");
 
     /* Don't trace getter or setter calls, our caller wants a direct slot. */
     if (PCVAL_IS_SPROP(pcval)) {
         JSScopeProperty* sprop = PCVAL_TO_SPROP(pcval);
 
-        uint32 setflags = (js_CodeSpec[*cx->fp->regs->pc].format & (JOF_SET | JOF_INCDEC | JOF_FOR));
-        if (setflags && !SPROP_HAS_STUB_SETTER(sprop))
-            ABORT_TRACE("non-stub setter");
-        if (setflags != JOF_SET && !SPROP_HAS_STUB_GETTER(sprop))
-            ABORT_TRACE("non-stub getter");
-        if (!SPROP_HAS_VALID_SLOT(sprop, OBJ_SCOPE(obj)))
-            ABORT_TRACE("no valid slot");
-        if (setflags && (sprop->attrs & JSPROP_READONLY))
-            ABORT_TRACE("writing to a readonly property");
+        if (!isValidSlot(OBJ_SCOPE(obj), sprop))
+            return false;
+
         slot = sprop->slot;
     } else {
         if (!PCVAL_IS_SLOT(pcval))
             ABORT_TRACE("PCE is not a slot");
         slot = PCVAL_TO_SLOT(pcval);
     }
     return true;
 }
@@ -5943,33 +5970,33 @@ TraceRecorder::getThis(LIns*& this_ins)
         guard(false, lir->ins_eq0(this_ins), MISMATCH_EXIT);
     } else { /* in global code */
         this_ins = scopeChain();
     }
     return true;
 }
 
 JS_REQUIRES_STACK bool
-TraceRecorder::guardClass(JSObject* obj, LIns* obj_ins, JSClass* clasp, ExitType exitType)
+TraceRecorder::guardClass(JSObject* obj, LIns* obj_ins, JSClass* clasp, LIns* exit)
 {
     bool cond = STOBJ_GET_CLASS(obj) == clasp;
 
     LIns* class_ins = lir->insLoad(LIR_ldp, obj_ins, offsetof(JSObject, classword));
     class_ins = lir->ins2(LIR_piand, class_ins, lir->insImm(~3));
 
     char namebuf[32];
     JS_snprintf(namebuf, sizeof namebuf, "guard(class is %s)", clasp->name);
-    guard(cond, addName(lir->ins2(LIR_eq, class_ins, INS_CONSTPTR(clasp)), namebuf), exitType);
+    guard(cond, addName(lir->ins2(LIR_eq, class_ins, INS_CONSTPTR(clasp)), namebuf), exit);
     return cond;
 }
 
 JS_REQUIRES_STACK bool
 TraceRecorder::guardDenseArray(JSObject* obj, LIns* obj_ins, ExitType exitType)
 {
-    return guardClass(obj, obj_ins, &js_ArrayClass, exitType);
+    return guardClass(obj, obj_ins, &js_ArrayClass, snapshot(exitType));
 }
 
 JS_REQUIRES_STACK bool
 TraceRecorder::guardDenseArrayIndex(JSObject* obj, jsint idx, LIns* obj_ins,
                                     LIns* dslots_ins, LIns* idx_ins, ExitType exitType)
 {
     jsuint capacity = js_DenseArrayCapacity(obj);
 
@@ -6572,16 +6599,24 @@ TraceRecorder::getClassPrototype(JSObjec
     if (!OBJ_GET_PROPERTY(cx, ctor,
                           ATOM_TO_JSID(cx->runtime->atomState
                                        .classPrototypeAtom),
                           &pval)) {
         ABORT_TRACE("error getting prototype from constructor");
     }
     if (JSVAL_TAG(pval) != JSVAL_OBJECT)
         ABORT_TRACE("got primitive prototype from constructor");
+#ifdef DEBUG
+    JSBool ok, found;
+    uintN attrs;
+    ok = JS_GetPropertyAttributes(cx, ctor, js_class_prototype_str, &attrs, &found);
+    JS_ASSERT(ok);
+    JS_ASSERT(found);
+    JS_ASSERT((~attrs & (JSPROP_READONLY | JSPROP_PERMANENT)) == 0);
+#endif
     proto_ins = INS_CONSTPTR(JSVAL_TO_OBJECT(pval));
     return true;
 }
 
 bool
 TraceRecorder::newArray(JSObject *ctor, uint32 argc, jsval *argv, jsval *rval)
 {
     LIns *proto_ins, *arr_ins;
@@ -6652,35 +6687,35 @@ TraceRecorder::functionCall(bool constru
      * Bytecode sequences that push shapeless callees must guard on the callee
      * class being Function and the function being interpreted.
      */
     JSFunction* fun = GET_FUNCTION_PRIVATE(cx, JSVAL_TO_OBJECT(fval));
 
     if (FUN_INTERPRETED(fun)) {
         if (constructing) {
             LIns* args[] = { get(&fval), cx_ins };
-            LIns* tv_ins = lir->insCall(&js_FastNewObject_ci, args);
+            LIns* tv_ins = lir->insCall(&js_NewInstance_ci, args);
             guard(false, lir->ins_eq0(tv_ins), OOM_EXIT);
             set(&tval, tv_ins);
         }
         return interpretedFunctionCall(fval, fun, argc, constructing);
     }
 
-    if (!constructing && !(fun->flags & JSFUN_TRACEABLE))
+    if (FUN_SLOW_NATIVE(fun) && fun->u.n.native == js_Array)
+        return newArray(FUN_OBJECT(fun), argc, &tval + 1, &fval);
+
+    if (!(fun->flags & JSFUN_TRACEABLE))
         ABORT_TRACE("untraceable native");
 
-    static JSTraceableNative knownNatives[] = {
-        { (JSFastNative)js_Object, &js_FastNewObject_ci,  "fC", "",    FAIL_NULL | JSTN_MORE },
-        { (JSFastNative)js_Date,   &js_FastNewDate_ci,    "pC", "",    FAIL_NULL },
-    };
+    JSTraceableNative* known = FUN_TRCINFO(fun);
+    JS_ASSERT(known && (JSFastNative)fun->u.n.native == known->native);
 
     LIns* args[5];
-    JSTraceableNative* known = constructing ? knownNatives : FUN_TRCINFO(fun);
     do {
-        if (constructing && (JSFastNative)fun->u.n.native != known->native)
+        if (((known->flags & JSTN_CONSTRUCTOR) != 0) != constructing)
             continue;
 
         uintN knownargc = strlen(known->argtypes);
         if (argc != knownargc)
             continue;
 
         intN prefixc = strlen(known->prefix);
         JS_ASSERT(prefixc <= 3);
@@ -6757,19 +6792,16 @@ TraceRecorder::functionCall(bool constru
             }
             argp--;
         }
         goto success;
 
 next_specialization:;
     } while ((known++)->flags & JSTN_MORE);
 
-    if (FUN_SLOW_NATIVE(fun) && fun->u.n.native == js_Array)
-        return newArray(FUN_OBJECT(fun), argc, &tval + 1, &fval);
-
     if (!constructing)
         ABORT_TRACE("unknown native");
     if (!(fun->flags & JSFUN_TRACEABLE) && FUN_CLASP(fun))
         ABORT_TRACE("can't trace native constructor");
     ABORT_TRACE("can't trace unknown constructor");
 
 success:
 #if defined _DEBUG
@@ -6987,38 +7019,53 @@ TraceRecorder::record_JSOP_SETPROP()
     if (obj->map->ops->setProperty != js_SetProperty)
         ABORT_TRACE("non-native JSObjectOps::setProperty");
     return true;
 }
 
 JS_REQUIRES_STACK bool
 TraceRecorder::record_SetPropHit(JSPropCacheEntry* entry, JSScopeProperty* sprop)
 {
-    if (sprop->setter == js_watch_set)
-        ABORT_TRACE("watchpoint detected");
-
     jsbytecode* pc = cx->fp->regs->pc;
     jsval& r = stackval(-1);
     jsval& l = stackval(-2);
 
     JS_ASSERT(!JSVAL_IS_PRIMITIVE(l));
     JSObject* obj = JSVAL_TO_OBJECT(l);
     LIns* obj_ins = get(&l);
 
-    if (sprop->attrs & JSPROP_READONLY)
-        ABORT_TRACE("SetPropHit on readonly prop");
+    if (!isValidSlot(OBJ_SCOPE(obj), sprop))
+        return false;
 
     if (obj == globalObj) {
         JS_ASSERT(SPROP_HAS_VALID_SLOT(sprop, OBJ_SCOPE(obj)));
         uint32 slot = sprop->slot;
         if (!lazilyImportGlobalSlot(slot))
             ABORT_TRACE("lazy import of global slot failed");
 
         LIns* r_ins = get(&r);
-        set(&STOBJ_GET_SLOT(obj, slot), r_ins);
+
+        if (JSVAL_IS_OBJECT(r)) {
+            /*
+             * Writing a function into the global object might rebrand it. We don't trace
+             * that case.
+             */
+            if (VALUE_IS_FUNCTION(cx, r))
+                ABORT_TRACE("potential rebranding of the global object");
+
+            /*
+             * If a regular object was written, we have to guard that it's not a function
+             * at execution time either. FIXME: We should split function and object into
+             * separate types when on trace (bug 481273).
+             */
+            guardClass(obj, obj_ins, &js_FunctionClass, snapshot(MISMATCH_EXIT));
+            set(&STOBJ_GET_SLOT(obj, slot), r_ins);
+        } else {
+            set(&STOBJ_GET_SLOT(obj, slot), r_ins);
+        }
 
         JS_ASSERT(*pc != JSOP_INITPROP);
         if (pc[JSOP_SETPROP_LENGTH] != JSOP_POP)
             set(&l, r_ins);
         return true;
     }
 
     // The global object's shape is guarded at trace entry, all others need a guard here.
@@ -7670,25 +7717,26 @@ TraceRecorder::prop(JSObject* obj, LIns*
 
     /* Check for non-existent property reference, which results in undefined. */
     const JSCodeSpec& cs = js_CodeSpec[*cx->fp->regs->pc];
     if (PCVAL_IS_NULL(pcval)) {
         /*
          * This trace will be valid as long as neither the object nor any object
          * on its prototype chain change shape.
          */
+        LIns* exit = snapshot(BRANCH_EXIT);
         for (;;) {
             LIns* map_ins = lir->insLoad(LIR_ldp, obj_ins, (int)offsetof(JSObject, map));
             LIns* ops_ins;
             if (map_is_native(obj->map, map_ins, ops_ins)) {
                 LIns* shape_ins = addName(lir->insLoad(LIR_ld, map_ins, offsetof(JSScope, shape)),
                                           "shape");
                 guard(true,
                       addName(lir->ins2i(LIR_eq, shape_ins, OBJ_SHAPE(obj)), "guard(shape)"),
-                      BRANCH_EXIT);
+                      exit);
             } else if (!guardDenseArray(obj, obj_ins, BRANCH_EXIT))
                 ABORT_TRACE("non-native object involved in undefined property access");
 
             obj = JSVAL_TO_OBJECT(obj->fslots[JSSLOT_PROTO]);
             if (!obj)
                 break;
             obj_ins = stobj_get_fslot(obj_ins, JSSLOT_PROTO);
         }
@@ -7774,21 +7822,38 @@ TraceRecorder::elem(jsval& oval, jsval& 
         return false;
 
     /* check that the index is within bounds */
     jsint i = JSVAL_TO_INT(idx);
     LIns* idx_ins = makeNumberInt32(get(&idx));
 
     LIns* dslots_ins = lir->insLoad(LIR_ldp, obj_ins, offsetof(JSObject, dslots));
     if (!guardDenseArrayIndex(obj, i, obj_ins, dslots_ins, idx_ins, BRANCH_EXIT)) {
-        LIns* rt_ins = lir->insLoad(LIR_ldp, cx_ins, offsetof(JSContext, runtime));
-        guard(true,
-              lir->ins_eq0(lir->insLoad(LIR_ldp, rt_ins,
-                                        offsetof(JSRuntime, anyArrayProtoHasElement))),
-              MISMATCH_EXIT);
+        /*
+         * If we read a hole, make sure at recording time and at runtime that nothing along
+         * the prototype has numeric properties.
+         */
+        if (js_PrototypeHasIndexedProperties(cx, obj))
+            return false;
+
+        LIns* exit = snapshot(BRANCH_EXIT);
+        while ((obj = JSVAL_TO_OBJECT(obj->fslots[JSSLOT_PROTO])) != NULL) {
+            obj_ins = stobj_get_fslot(obj_ins, JSSLOT_PROTO);
+            LIns* map_ins = lir->insLoad(LIR_ldp, obj_ins, (int)offsetof(JSObject, map));
+            LIns* ops_ins;
+            if (!map_is_native(obj->map, map_ins, ops_ins))
+                ABORT_TRACE("non-native object involved along prototype chain");
+
+            LIns* shape_ins = addName(lir->insLoad(LIR_ld, map_ins, offsetof(JSScope, shape)),
+                                      "shape");
+            guard(true,
+                  addName(lir->ins2i(LIR_eq, shape_ins, OBJ_SHAPE(obj)), "guard(shape)"),
+                  exit);
+        }
+
         // Return undefined and indicate that we didn't actually read this (addr_ins).
         v_ins = lir->insImm(JSVAL_TO_PSEUDO_BOOLEAN(JSVAL_VOID));
         addr_ins = NULL;
         return true;
     }
 
     // We can't "see through" a hole to a possible Array.prototype property, so
     // we abort here and guard below (after unboxing).
@@ -8029,17 +8094,17 @@ TraceRecorder::record_JSOP_NEWINIT()
         ci = &js_FastNewArray_ci;
     } else {
         jsval v_obj;
         if (!js_FindClassObject(cx, globalObj, INT_TO_JSID(key), &v_obj))
             return false;
         if (JSVAL_IS_PRIMITIVE(v_obj))
             ABORT_TRACE("primitive Object value");
         obj = JSVAL_TO_OBJECT(v_obj);
-        ci = &js_FastNewObject_ci;
+        ci = &js_Object_tn_ci;
     }
     LIns* args[] = { INS_CONSTPTR(obj), cx_ins };
     LIns* v_ins = lir->insCall(ci, args);
     guard(false, lir->ins_eq0(v_ins), OOM_EXIT);
     stack(0, v_ins);
     return true;
 }
 
@@ -8159,18 +8224,20 @@ TraceRecorder::record_JSOP_ITER()
 JS_REQUIRES_STACK bool
 TraceRecorder::record_JSOP_NEXTITER()
 {
     jsval& iterobj_val = stackval(-2);
     if (JSVAL_IS_PRIMITIVE(iterobj_val))
         ABORT_TRACE("for-in on a primitive value");
 
     LIns* iterobj_ins = get(&iterobj_val);
-    if (guardClass(JSVAL_TO_OBJECT(iterobj_val), iterobj_ins, &js_IteratorClass, BRANCH_EXIT))
+    if (guardClass(JSVAL_TO_OBJECT(iterobj_val), iterobj_ins, &js_IteratorClass,
+                   snapshot(BRANCH_EXIT))) {
         return call_imacro(nextiter_imacros.native_iter_next);
+    }
     return call_imacro(nextiter_imacros.custom_iter_next);
 }
 
 JS_REQUIRES_STACK bool
 TraceRecorder::record_JSOP_ENDITER()
 {
     LIns* args[] = { stack(-2), cx_ins };
     LIns* ok_ins = lir->insCall(&js_CloseIterator_ci, args);
@@ -9398,23 +9465,16 @@ TraceRecorder::record_JSOP_NEWARRAY()
     if (!js_GetClassPrototype(cx, globalObj, INT_TO_JSID(JSProto_Array), &proto))
         return false;
 
     uint32 len = GET_UINT24(cx->fp->regs->pc);
     LIns* args[] = { lir->insImm(len), INS_CONSTPTR(proto), cx_ins };
     LIns* v_ins = lir->insCall(ci, args);
     guard(false, lir->ins_eq0(v_ins), OOM_EXIT);
 
-    // De-optimize when we might have setters on Array.prototype.
-    LIns* rt_ins = lir->insLoad(LIR_ldp, cx_ins, offsetof(JSContext, runtime));
-    guard(true,
-          lir->ins_eq0(lir->insLoad(LIR_ldp, rt_ins,
-                                    offsetof(JSRuntime, anyArrayProtoHasElement))),
-          MISMATCH_EXIT);
-
     LIns* dslots_ins = NULL;
     for (uint32 i = 0; i < len; i++) {
         jsval& v = stackval(int(i) - int(len));
         LIns* elt_ins = get(&v);
         box_jsval(v, elt_ins);
         stobj_set_dslot(v_ins, i, dslots_ins, elt_ins, "set_array_elt");
     }
 

--- a/js/src/jstracer.h
+++ b/js/src/jstracer.h
@@ -413,27 +413,28 @@ class TraceRecorder : public avmplus::GC
     Queue<jsbytecode*>      cfgMerges;
     jsval*                  global_dslots;
     JSTraceableNative*      pendingTraceableNative;
     bool                    terminate;
     jsbytecode*             terminate_pc;
     jsbytecode*             terminate_imacpc;
     TraceRecorder*          nextRecorderToAbort;
     bool                    wasRootFragment;
-    nanojit::Fragment*      outer;
+    jsbytecode*             outer;
 
     bool isGlobal(jsval* p) const;
     ptrdiff_t nativeGlobalOffset(jsval* p) const;
     JS_REQUIRES_STACK ptrdiff_t nativeStackOffset(jsval* p) const;
     JS_REQUIRES_STACK void import(nanojit::LIns* base, ptrdiff_t offset, jsval* p, uint8& t,
                                   const char *prefix, uintN index, JSStackFrame *fp);
     JS_REQUIRES_STACK void import(TreeInfo* treeInfo, nanojit::LIns* sp, unsigned stackSlots,
                                   unsigned callDepth, unsigned ngslots, uint8* typeMap);
     void trackNativeStackUse(unsigned slots);
 
+    JS_REQUIRES_STACK bool isValidSlot(JSScope* scope, JSScopeProperty* sprop);
     JS_REQUIRES_STACK bool lazilyImportGlobalSlot(unsigned slot);
 
     JS_REQUIRES_STACK nanojit::LIns* guard(bool expected, nanojit::LIns* cond,
                                            ExitType exitType);
     nanojit::LIns* guard(bool expected, nanojit::LIns* cond, nanojit::LIns* exit);
 
     nanojit::LIns* addName(nanojit::LIns* ins, const char* name);
 
@@ -524,17 +525,17 @@ class TraceRecorder : public avmplus::GC
                                 nanojit::LIns*& addr_ins);
     JS_REQUIRES_STACK bool getProp(JSObject* obj, nanojit::LIns* obj_ins);
     JS_REQUIRES_STACK bool getProp(jsval& v);
     JS_REQUIRES_STACK bool getThis(nanojit::LIns*& this_ins);
 
     JS_REQUIRES_STACK void box_jsval(jsval v, nanojit::LIns*& v_ins);
     JS_REQUIRES_STACK void unbox_jsval(jsval v, nanojit::LIns*& v_ins);
     JS_REQUIRES_STACK bool guardClass(JSObject* obj, nanojit::LIns* obj_ins, JSClass* clasp,
-                                      ExitType exitType = MISMATCH_EXIT);
+                                      nanojit::LIns* exit);
     JS_REQUIRES_STACK bool guardDenseArray(JSObject* obj, nanojit::LIns* obj_ins,
                                            ExitType exitType = MISMATCH_EXIT);
     JS_REQUIRES_STACK bool guardDenseArrayIndex(JSObject* obj, jsint idx, nanojit::LIns* obj_ins,
                                                 nanojit::LIns* dslots_ins, nanojit::LIns* idx_ins,
                                                 ExitType exitType);
     JS_REQUIRES_STACK bool guardElemOp(JSObject* obj, nanojit::LIns* obj_ins, jsid id,
                                        size_t op_offset, jsval* vp);
     void clearFrameSlotsFromCache();
@@ -551,17 +552,17 @@ class TraceRecorder : public avmplus::GC
 
     bool hasMethod(JSObject* obj, jsid id);
     JS_REQUIRES_STACK bool hasIteratorMethod(JSObject* obj);
 
 public:
     JS_REQUIRES_STACK
     TraceRecorder(JSContext* cx, VMSideExit*, nanojit::Fragment*, TreeInfo*,
                   unsigned stackSlots, unsigned ngslots, uint8* typeMap,
-                  VMSideExit* expectedInnerExit, nanojit::Fragment* outerTree);
+                  VMSideExit* expectedInnerExit, jsbytecode* outerTree);
     ~TraceRecorder();
 
     static JS_REQUIRES_STACK JSMonitorRecordingStatus monitorRecording(JSContext* cx, TraceRecorder* tr, JSOp op);
 
     JS_REQUIRES_STACK uint8 determineSlotType(jsval* vp);
     JS_REQUIRES_STACK nanojit::LIns* snapshot(ExitType exitType);
     nanojit::Fragment* getFragment() const { return fragment; }
     TreeInfo* getTreeInfo() const { return treeInfo; }

--- a/js/src/jstypes.h
+++ b/js/src/jstypes.h
@@ -446,11 +446,36 @@ typedef uintptr_t JSUword;
 #define JS_ARRAY_END(array)    ((array) + JS_ARRAY_LENGTH(array))
 
 #define JS_BITS_PER_BYTE 8
 #define JS_BITS_PER_BYTE_LOG2 3
 
 #define JS_BITS_PER_WORD (JS_BITS_PER_BYTE * JS_BYTES_PER_WORD)
 #define JS_BITS_PER_DOUBLE (JS_BITS_PER_BYTE * JS_BYTES_PER_DOUBLE)
 
+/***********************************************************************
+** MACROS:      JS_FUNC_TO_DATA_PTR
+**              JS_DATA_TO_FUNC_PTR
+** DESCRIPTION:
+**      Macros to convert between function and data pointers assuming that
+**      they have the same size. Use them like this:
+**
+**      JSPropertyOp nativeGetter;
+**      JSObject *scriptedGetter;
+**      ...
+**      scriptedGetter = JS_FUNC_TO_DATA_PTR(JSObject *, nativeGetter);
+**      ...
+**      nativeGetter = JS_DATA_TO_FUNC_PTR(JSPropertyOp, scriptedGetter);
+**
+***********************************************************************/
+
+#ifdef __GNUC__
+# define JS_FUNC_TO_DATA_PTR(type, fun) (__extension__ (type) (fun))
+# define JS_DATA_TO_FUNC_PTR(type, ptr) (__extension__ (type) (ptr))
+#else
+/* Use an extra (void *) cast for MSVC. */
+# define JS_FUNC_TO_DATA_PTR(type, fun) ((type) (void *) (fun))
+# define JS_DATA_TO_FUNC_PTR(type, ptr) ((type) (void *) (ptr))
+#endif
+
 JS_END_EXTERN_C
 
 #endif /* jstypes_h___ */

--- a/js/src/jsutil.cpp
+++ b/js/src/jsutil.cpp
@@ -45,16 +45,22 @@
 #include <stdlib.h>
 #include "jstypes.h"
 #include "jsutil.h"
 
 #ifdef WIN32
 #    include <windows.h>
 #endif
 
+/*
+ * Checks the assumption that JS_FUNC_TO_DATA_PTR and JS_DATA_TO_FUNC_PTR
+ * macros uses to implement casts between function and data pointers.
+ */
+JS_STATIC_ASSERT(sizeof(void *) == sizeof(void (*)()));
+
 JS_PUBLIC_API(void) JS_Assert(const char *s, const char *file, JSIntn ln)
 {
     fprintf(stderr, "Assertion failure: %s, at %s:%d\n", s, file, ln);
 #if defined(WIN32)
     DebugBreak();
     exit(3);
 #elif defined(XP_OS2) || (defined(__GNUC__) && defined(__i386))
     asm("int $3");

--- a/js/src/jsutil.h
+++ b/js/src/jsutil.h
@@ -41,21 +41,25 @@
  * PR assertion checker.
  */
 
 #ifndef jsutil_h___
 #define jsutil_h___
 
 JS_BEGIN_EXTERN_C
 
-#ifdef DEBUG
-
+/*
+ * JS_Assert is present even in release builds, for the benefit of applications
+ * that build DEBUG and link against a non-DEBUG SpiderMonkey library.
+ */
 extern JS_PUBLIC_API(void)
 JS_Assert(const char *s, const char *file, JSIntn ln);
 
+#ifdef DEBUG
+
 #define JS_ASSERT(expr)                                                       \
     ((expr) ? (void)0 : JS_Assert(#expr, __FILE__, __LINE__))
 
 #define JS_ASSERT_IF(cond, expr)                                              \
     ((!(cond) || (expr)) ? (void)0 : JS_Assert(#expr, __FILE__, __LINE__))
 
 #define JS_NOT_REACHED(reason)                                                \
     JS_Assert(reason, __FILE__, __LINE__)
@@ -88,16 +92,18 @@ JS_Assert(const char *s, const char *fil
     #define JS_STATIC_ASSERT_GLUE(x,y) JS_STATIC_ASSERT_GLUE1(x,y)
     #define JS_STATIC_ASSERT(cond)                                            \
         typedef int JS_STATIC_ASSERT_GLUE(js_static_assert, __COUNTER__)[(cond) ? 1 : -1]
 #else
     #define JS_STATIC_ASSERT(cond) extern void js_static_assert(int arg[(cond) ? 1 : -1])
 #endif
 #endif
 
+#define JS_STATIC_ASSERT_IF(cond, expr) JS_STATIC_ASSERT(!(cond) || (expr))
+
 /*
  * Abort the process in a non-graceful manner. This will cause a core file,
  * call to the debugger or other moral equivalent as well as causing the
  * entire process to stop.
  */
 extern JS_PUBLIC_API(void) JS_Abort(void);
 
 #if 0

--- a/js/src/nanojit/Assembler.cpp
+++ b/js/src/nanojit/Assembler.cpp
@@ -926,16 +926,21 @@ namespace nanojit
 		}
 		
 		NanoAssertMsgf(error() || _fpuStkDepth == 0,"_fpuStkDepth %d",_fpuStkDepth);
 
 		internalReset();  // clear the reservation tables and regalloc
 		NanoAssert( !_branchStateMap || _branchStateMap->isEmpty());
 		_branchStateMap = 0;
 
+        // Tell Valgrind that new code has been generated, and it must flush
+        // any translations it has for the memory range generated into.
+        VALGRIND_DISCARD_TRANSLATIONS(pageTop(_nIns-1),     NJ_PAGE_SIZE);
+        VALGRIND_DISCARD_TRANSLATIONS(pageTop(_nExitIns-1), NJ_PAGE_SIZE);
+
 #ifdef AVMPLUS_ARM
 		// If we've modified the code, we need to flush so we don't end up trying 
 		// to execute junk
 # if defined(UNDER_CE)
 		FlushInstructionCache(GetCurrentProcess(), NULL, NULL);
 # elif defined(AVMPLUS_UNIX)
 		for (int i = 0; i < 2; i++) {
 			Page *p = (i == 0) ? _nativePages : _nativeExitPages;

--- a/js/src/nanojit/NativeARM.cpp
+++ b/js/src/nanojit/NativeARM.cpp
@@ -402,16 +402,17 @@ Assembler::nPatchBranch(NIns* at, NIns* 
         // great, just stick it in at[0]
         at[0] = (NIns)( COND_AL | (0xA<<24) | ((offs >> 2) & 0xffffff) );
         // and reset at[1] for good measure
         at[1] = BKPT_insn;
     } else {
         at[0] = (NIns)( COND_AL | (0x51<<20) | (PC<<16) | (PC<<12) | (4) );
         at[1] = (NIns)(target);
     }
+    VALGRIND_DISCARD_TRANSLATIONS(at, 2*sizeof(NIns));
 
 #if defined(UNDER_CE)
     // we changed the code, so we need to do this (sadly)
     FlushInstructionCache(GetCurrentProcess(), NULL, NULL);
 #elif defined(AVMPLUS_LINUX)
     __clear_cache((char*)at, (char*)(at+3));
 #endif
 

--- a/js/src/nanojit/Nativei386.cpp
+++ b/js/src/nanojit/Nativei386.cpp
@@ -411,27 +411,30 @@ namespace nanojit
 	NIns* Assembler::nPatchBranch(NIns* branch, NIns* targ)
 	{
 #if defined NANOJIT_IA32
         NIns* was = 0;
 		intptr_t offset = intptr_t(targ) - intptr_t(branch);
 		if (branch[0] == JMP32) {
             was = branch + *(int32_t*)&branch[1] + 5;
 		    *(int32_t*)&branch[1] = offset - 5;
+            VALGRIND_DISCARD_TRANSLATIONS(&branch[1], sizeof(int32_t));
 		} else if (branch[0] == JCC32) {
             was = branch + *(int32_t*)&branch[2] + 6;
 		    *(int32_t*)&branch[2] = offset - 6;
+            VALGRIND_DISCARD_TRANSLATIONS(&branch[2], sizeof(int32_t));
 		} else
 		    NanoAssertMsg(0, "Unknown branch type in nPatchBranch");
 #else
         if (branch[0] == 0xFF && branch[1] == 0x25) {
             NIns *mem;
             mem = &branch[6] + *(int32_t *)&branch[2];
             was = *(intptr_t*)mem;
             *(intptr_t *)mem = intptr_t(targ);
+            VALGRIND_DISCARD_TRANSLATIONS(mem, sizeof(intptr_t));
         } else {
             NanoAssertMsg(0, "Unknown branch type in nPatchBranch");
         }
 #endif
         return was;
 	}
 
 	RegisterMask Assembler::hint(LIns* i, RegisterMask allow)
@@ -2093,15 +2096,18 @@ namespace nanojit
 	// enough room for n bytes
     void Assembler::underrunProtect(int n)
     {
 		NanoAssertMsg(n<=LARGEST_UNDERRUN_PROT, "constant LARGEST_UNDERRUN_PROT is too small"); 
         NIns *eip = this->_nIns;
         Page *p = (Page*)pageTop(eip-1);
         NIns *top = (NIns*) &p->code[0];
         if (eip - n < top) {
+            // We are done with the current page.  Tell Valgrind that new code
+            // has been generated.
+            VALGRIND_DISCARD_TRANSLATIONS(pageTop(p), NJ_PAGE_SIZE);
 			_nIns = pageAlloc(_inExit);
             JMP(eip);
         }
     }
 	
 	#endif /* FEATURE_NANOJIT */
 }