Bug 915763 - Remove TypeScript::dynamicList and dynamic Monitor functions. r=bhackett
authorJan de Mooij <jdemooij@mozilla.com>
Sat, 28 Sep 2013 11:45:21 +0200
changeset 162962 f98f80d2126ca8bd544fcf4e8d2e36ee40884ae5
parent 162961 e087b5e210770acb17c2504b0f01ac8af62b9078
child 162963 8918bc282c8ae3e37b52af44124245616d65e181
push id3066
push userakeybl@mozilla.com
push dateMon, 09 Dec 2013 19:58:46 +0000
treeherdermozilla-beta@a31a0dce83aa [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs915763
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 915763 - Remove TypeScript::dynamicList and dynamic Monitor functions. r=bhackett
js/public/MemoryMetrics.h
js/src/jit-test/tests/ion/bug875804.js
js/src/jit/BaselineBailouts.cpp
js/src/jit/BaselineIC.cpp
js/src/jit/BaselineIC.h
js/src/jit/BaselineInspector.cpp
js/src/jit/BaselineInspector.h
js/src/jit/CodeGenerator.cpp
js/src/jit/IonBuilder.cpp
js/src/jit/IonTypes.h
js/src/jit/Lowering.cpp
js/src/jit/MIR.cpp
js/src/jit/MIR.h
js/src/jit/TypePolicy.cpp
js/src/jit/VMFunctions.cpp
js/src/jit/arm/Lowering-arm.cpp
js/src/jit/shared/Lowering-x86-shared.cpp
js/src/jsinfer.cpp
js/src/jsinfer.h
js/src/jsinferinlines.h
js/src/jsiter.cpp
js/src/jsscript.cpp
js/src/vm/Interpreter-inl.h
js/src/vm/Interpreter.cpp
js/src/vm/Interpreter.h
js/xpconnect/src/XPCJSRuntime.cpp
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -147,17 +147,16 @@ struct ObjectsExtraSizes
 #undef FOR_EACH_SIZE
 };
 
 // Data for tracking analysis/inference memory usage.
 struct TypeInferenceSizes
 {
 #define FOR_EACH_SIZE(macro) \
     macro(js::NotLiveGCThing, typeScripts) \
-    macro(js::NotLiveGCThing, typeResults) \
     macro(js::NotLiveGCThing, pendingArrays) \
     macro(js::NotLiveGCThing, allocationSiteTables) \
     macro(js::NotLiveGCThing, arrayTypeTables) \
     macro(js::NotLiveGCThing, objectTypeTables)
 
     TypeInferenceSizes()
       : FOR_EACH_SIZE(ZERO_SIZE)
         dummy()
--- a/js/src/jit-test/tests/ion/bug875804.js
+++ b/js/src/jit-test/tests/ion/bug875804.js
@@ -1,11 +1,11 @@
 
 eval('(function () {\
 function range(n) {\
-  for (var i = 0; i < 100000; i++)\
+  for (var i = 0; i < 5000; i++)\
     yield i;\
 }\
 var r = range(10);\
 var i = 0;\
 for (var x in r)\
   assertEq(x,i++);\
-' + '})();');
\ No newline at end of file
+' + '})();');
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -1370,32 +1370,25 @@ HandleShapeGuardFailure(JSContext *cx, H
     // the flag on innerScript as opposed to outerScript, and maybe invalidating both
     // inner and outer scripts, instead of just the outer one.
     outerScript->failedShapeGuard = true;
     IonSpew(IonSpew_BaselineBailouts, "Invalidating due to shape guard failure");
     return Invalidate(cx, outerScript);
 }
 
 static bool
-HandleCachedShapeGuardFailure(JSContext *cx, HandleScript outerScript, HandleScript innerScript)
+HandleBaselineInfoBailout(JSContext *cx, JSScript *outerScript, JSScript *innerScript)
 {
-    IonSpew(IonSpew_Bailouts, "Cached shape guard failure %s:%d, inlined into %s:%d",
+    IonSpew(IonSpew_Bailouts, "Baseline info failure %s:%d, inlined into %s:%d",
             innerScript->filename(), innerScript->lineno,
             outerScript->filename(), outerScript->lineno);
 
     JS_ASSERT(!outerScript->ionScript()->invalidated());
 
-    outerScript->failedShapeGuard = true;
-
-    // No need to purge baseline ICs.  Baseline will do one of two things: add a new
-    // optimized stub (preventing monomorphic IC caching), or set a flag indicating that
-    // an unoptimizable access was made, also preventing mono IC caching.
-
-    IonSpew(IonSpew_BaselineBailouts, "Invalidating due to cached shape guard failure");
-
+    IonSpew(IonSpew_BaselineBailouts, "Invalidating due to invalid baseline info");
     return Invalidate(cx, outerScript);
 }
 
 uint32_t
 jit::FinishBailoutToBaseline(BaselineBailoutInfo *bailoutInfo)
 {
     // The caller pushes R0 and R1 on the stack without rooting them.
     // Since GC here is very unlikely just suppress it.
@@ -1482,32 +1475,28 @@ jit::FinishBailoutToBaseline(BaselineBai
             innerScript->filename(), innerScript->lineno, innerScript->getUseCount(),
             (unsigned) bailoutKind);
 
     switch (bailoutKind) {
       case Bailout_Normal:
         // Do nothing.
         break;
       case Bailout_ArgumentCheck:
-      case Bailout_TypeBarrier:
-      case Bailout_Monitor:
-        // Reflow types.  But in baseline, this will happen automatically because
-        // for any monitored op (or for argument checks), bailout will resume into
-        // the monitoring IC which will handle the type updates.
+        // Do nothing, bailout will resume before the argument monitor ICs.
         break;
       case Bailout_BoundsCheck:
         if (!HandleBoundsCheckFailure(cx, outerScript, innerScript))
             return false;
         break;
       case Bailout_ShapeGuard:
         if (!HandleShapeGuardFailure(cx, outerScript, innerScript))
             return false;
         break;
-      case Bailout_CachedShapeGuard:
-        if (!HandleCachedShapeGuardFailure(cx, outerScript, innerScript))
+      case Bailout_BaselineInfo:
+        if (!HandleBaselineInfoBailout(cx, outerScript, innerScript))
             return false;
         break;
       default:
         MOZ_ASSUME_UNREACHABLE("Unknown bailout kind!");
     }
 
     if (!CheckFrequentBailouts(cx, outerScript))
         return false;
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -2456,33 +2456,33 @@ DoBinaryArithFallback(JSContext *cx, Bas
     // generating stubs.
     RootedValue lhsCopy(cx, lhs);
     RootedValue rhsCopy(cx, rhs);
 
     // Perform the compare operation.
     switch(op) {
       case JSOP_ADD:
         // Do an add.
-        if (!AddValues(cx, script, pc, &lhsCopy, &rhsCopy, ret.address()))
+        if (!AddValues(cx, &lhsCopy, &rhsCopy, ret.address()))
             return false;
         break;
       case JSOP_SUB:
-        if (!SubValues(cx, script, pc, &lhsCopy, &rhsCopy, ret.address()))
+        if (!SubValues(cx, &lhsCopy, &rhsCopy, ret.address()))
             return false;
         break;
       case JSOP_MUL:
-        if (!MulValues(cx, script, pc, &lhsCopy, &rhsCopy, ret.address()))
+        if (!MulValues(cx, &lhsCopy, &rhsCopy, ret.address()))
             return false;
         break;
       case JSOP_DIV:
-        if (!DivValues(cx, script, pc, &lhsCopy, &rhsCopy, ret.address()))
+        if (!DivValues(cx, &lhsCopy, &rhsCopy, ret.address()))
             return false;
         break;
       case JSOP_MOD:
-        if (!ModValues(cx, script, pc, &lhsCopy, &rhsCopy, ret.address()))
+        if (!ModValues(cx, &lhsCopy, &rhsCopy, ret.address()))
             return false;
         break;
       case JSOP_BITOR: {
         int32_t result;
         if (!BitOr(cx, lhs, rhs, &result))
             return false;
         ret.setInt32(result);
         break;
@@ -2511,17 +2511,17 @@ DoBinaryArithFallback(JSContext *cx, Bas
       case JSOP_RSH: {
         int32_t result;
         if (!BitRsh(cx, lhs, rhs, &result))
             return false;
         ret.setInt32(result);
         break;
       }
       case JSOP_URSH: {
-        if (!UrshOperation(cx, script, pc, lhs, rhs, ret.address()))
+        if (!UrshOperation(cx, lhs, rhs, ret.address()))
             return false;
         break;
       }
       default:
         MOZ_ASSUME_UNREACHABLE("Unhandled baseline arith op");
     }
 
     if (ret.isDouble())
@@ -8686,16 +8686,19 @@ DoIteratorNextFallback(JSContext *cx, Ba
                        HandleValue iterValue, MutableHandleValue res)
 {
     FallbackICSpew(cx, stub, "IteratorNext");
 
     RootedObject iteratorObject(cx, &iterValue.toObject());
     if (!IteratorNext(cx, iteratorObject, res))
         return false;
 
+    if (!res.isString() && !stub->hasNonStringResult())
+        stub->setHasNonStringResult();
+
     if (iteratorObject->is<PropertyIteratorObject>() &&
         !stub->hasStub(ICStub::IteratorNext_Native))
     {
         ICIteratorNext_Native::Compiler compiler(cx);
         ICStub *newStub = compiler.getStub(compiler.getStubSpace(frame->script()));
         if (!newStub)
             return false;
         stub->addNewStub(newStub);
--- a/js/src/jit/BaselineIC.h
+++ b/js/src/jit/BaselineIC.h
@@ -5609,16 +5609,24 @@ class ICIteratorNext_Fallback : public I
 
   public:
     static inline ICIteratorNext_Fallback *New(ICStubSpace *space, IonCode *code) {
         if (!code)
             return nullptr;
         return space->allocate<ICIteratorNext_Fallback>(code);
     }
 
+    void setHasNonStringResult() {
+        JS_ASSERT(extra_ == 0);
+        extra_ = 1;
+    }
+    bool hasNonStringResult() const {
+        return extra_;
+    }
+
     class Compiler : public ICStubCompiler {
       protected:
         bool generateStubCode(MacroAssembler &masm);
 
       public:
         Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::IteratorNext_Fallback)
         { }
--- a/js/src/jit/BaselineInspector.cpp
+++ b/js/src/jit/BaselineInspector.cpp
@@ -347,16 +347,30 @@ BaselineInspector::hasSeenAccessedGetter
     ICStub *stub = entry.fallbackStub();
 
     if (stub->isGetProp_Fallback())
         return stub->toGetProp_Fallback()->hasAccessedGetter();
     return false;
 }
 
 bool
+BaselineInspector::hasSeenNonStringIterNext(jsbytecode *pc)
+{
+    JS_ASSERT(JSOp(*pc) == JSOP_ITERNEXT);
+
+    if (!hasBaselineScript())
+        return false;
+
+    const ICEntry &entry = icEntryFromPC(pc);
+    ICStub *stub = entry.fallbackStub();
+
+    return stub->toIteratorNext_Fallback()->hasNonStringResult();
+}
+
+bool
 BaselineInspector::hasSeenDoubleResult(jsbytecode *pc)
 {
     if (!hasBaselineScript())
         return false;
 
     const ICEntry &entry = icEntryFromPC(pc);
     ICStub *stub = entry.fallbackStub();
 
--- a/js/src/jit/BaselineInspector.h
+++ b/js/src/jit/BaselineInspector.h
@@ -104,16 +104,17 @@ class BaselineInspector
     MIRType expectedResultType(jsbytecode *pc);
     MCompare::CompareType expectedCompareType(jsbytecode *pc);
     MIRType expectedBinaryArithSpecialization(jsbytecode *pc);
 
     bool hasSeenNonNativeGetElement(jsbytecode *pc);
     bool hasSeenNegativeIndexGetElement(jsbytecode *pc);
     bool hasSeenAccessedGetter(jsbytecode *pc);
     bool hasSeenDoubleResult(jsbytecode *pc);
+    bool hasSeenNonStringIterNext(jsbytecode *pc);
 };
 
 } // namespace jit
 } // namespace js
 
 #endif // JS_ION
 
 #endif /* jit_BaselineInspector_h */
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -3860,39 +3860,33 @@ CodeGenerator::visitModD(LModD *ins)
 
     if (gen->compilingAsmJS())
         masm.callWithABI(AsmJSImm_ModD, MacroAssembler::DOUBLE);
     else
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MacroAssembler::DOUBLE);
     return true;
 }
 
-typedef bool (*BinaryFn)(JSContext *, HandleScript, jsbytecode *,
-                         MutableHandleValue, MutableHandleValue, Value *);
-typedef ParallelResult (*BinaryParFn)(ForkJoinSlice *, HandleValue, HandleValue,
-                                      Value *);
+typedef bool (*BinaryFn)(JSContext *, MutableHandleValue, MutableHandleValue, Value *);
+typedef ParallelResult (*BinaryParFn)(ForkJoinSlice *, HandleValue, HandleValue, Value *);
 
 static const VMFunction AddInfo = FunctionInfo<BinaryFn>(js::AddValues);
 static const VMFunction SubInfo = FunctionInfo<BinaryFn>(js::SubValues);
 static const VMFunction MulInfo = FunctionInfo<BinaryFn>(js::MulValues);
 static const VMFunction DivInfo = FunctionInfo<BinaryFn>(js::DivValues);
 static const VMFunction ModInfo = FunctionInfo<BinaryFn>(js::ModValues);
 static const VMFunctionsModal UrshInfo = VMFunctionsModal(
     FunctionInfo<BinaryFn>(js::UrshValues),
     FunctionInfo<BinaryParFn>(UrshValuesPar));
 
 bool
 CodeGenerator::visitBinaryV(LBinaryV *lir)
 {
     pushArg(ToValue(lir, LBinaryV::RhsInput));
     pushArg(ToValue(lir, LBinaryV::LhsInput));
-    if (gen->info().executionMode() == SequentialExecution) {
-        pushArg(ImmPtr(lir->mirRaw()->toInstruction()->resumePoint()->pc()));
-        pushArg(ImmGCPtr(current->mir()->info().script()));
-    }
 
     switch (lir->jsop()) {
       case JSOP_ADD:
         return callVM(AddInfo, lir);
 
       case JSOP_SUB:
         return callVM(SubInfo, lir);
 
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -3769,17 +3769,17 @@ IonBuilder::inlineScriptedCall(CallInfo 
 
     // Improve type information of |this| when not set.
     if (callInfo.constructing() &&
         !callInfo.thisArg()->resultTypeSet() &&
         calleeScript->types)
     {
         types::StackTypeSet *types = types::TypeScript::ThisTypes(calleeScript);
         if (!types->unknown()) {
-            MTypeBarrier *barrier = MTypeBarrier::New(callInfo.thisArg(), cloneTypeSet(types), Bailout_Normal);
+            MTypeBarrier *barrier = MTypeBarrier::New(callInfo.thisArg(), cloneTypeSet(types));
             current->add(barrier);
             callInfo.setThis(barrier);
         }
     }
 
     // Start inlining.
     LifoAlloc *alloc = GetIonContext()->temp->lifoAlloc();
     CompileInfo *info = alloc->new_<CompileInfo>(calleeScript, target,
@@ -8530,17 +8530,17 @@ IonBuilder::getPropTryInlineAccess(bool 
 
     MDefinition *obj = current->pop();
     if (shapes.length() == 1) {
         // In the monomorphic case, use separate ShapeGuard and LoadSlot
         // instructions.
         spew("Inlining monomorphic GETPROP");
 
         Shape *objShape = shapes[0];
-        obj = addShapeGuard(obj, objShape, Bailout_CachedShapeGuard);
+        obj = addShapeGuard(obj, objShape, Bailout_ShapeGuard);
 
         Shape *shape = objShape->search(cx, id);
         JS_ASSERT(shape);
 
         if (!loadSlot(obj, shape, rvalType, barrier, types))
             return false;
     } else {
         JS_ASSERT(shapes.length() > 1);
@@ -8938,17 +8938,17 @@ IonBuilder::setPropTryInlineAccess(bool 
     if (shapes.length() == 1) {
         spew("Inlining monomorphic SETPROP");
 
         // The Baseline IC was monomorphic, so we inline the property access as
         // long as the shape is not in dictionary mode. We cannot be sure
         // that the shape is still a lastProperty, and calling Shape::search
         // on dictionary mode shapes that aren't lastProperty is invalid.
         Shape *objShape = shapes[0];
-        obj = addShapeGuard(obj, objShape, Bailout_CachedShapeGuard);
+        obj = addShapeGuard(obj, objShape, Bailout_ShapeGuard);
 
         Shape *shape = objShape->search(cx, NameToId(name));
         JS_ASSERT(shape);
 
         bool needsBarrier = objTypes->propertyNeedsBarrier(cx, id);
         if (!storeSlot(obj, shape, value, needsBarrier))
             return false;
     } else {
@@ -9224,18 +9224,18 @@ IonBuilder::jsop_iternext()
     MInstruction *ins = MIteratorNext::New(iter);
 
     current->add(ins);
     current->push(ins);
 
     if (!resumeAfter(ins))
         return false;
 
-    if (!nonStringIteration_ && types::IterationValuesMustBeStrings(script())) {
-        ins = MUnbox::New(ins, MIRType_String, MUnbox::Infallible);
+    if (!nonStringIteration_ && !inspector->hasSeenNonStringIterNext(pc)) {
+        ins = MUnbox::New(ins, MIRType_String, MUnbox::Fallible, Bailout_BaselineInfo);
         current->add(ins);
         current->rewriteAtDepth(-1, ins);
     }
 
     return true;
 }
 
 bool
--- a/js/src/jit/IonTypes.h
+++ b/js/src/jit/IonTypes.h
@@ -26,52 +26,41 @@ enum BailoutKind
     // A normal bailout triggered from type, shape, and assorted overflow
     // guards in the compiler.
     Bailout_Normal,
 
     // A bailout at the very start of a function indicates that there may be
     // a type mismatch in the arguments that necessitates a reflow.
     Bailout_ArgumentCheck,
 
-    // A bailout required to monitor a newly observed type in a type inference
-    // barrier.
-    Bailout_TypeBarrier,
-
-    // A bailout required to monitor the result of a VM call.
-    Bailout_Monitor,
-
     // A bailout triggered by a bounds-check failure.
     Bailout_BoundsCheck,
 
     // A shape guard based on TI information failed.
     Bailout_ShapeGuard,
 
-    // A shape guard based on JM ICs failed.
-    Bailout_CachedShapeGuard
+    // A bailout caused by invalid assumptions based on Baseline code.
+    Bailout_BaselineInfo
 };
 
 #ifdef DEBUG
 inline const char *
 BailoutKindString(BailoutKind kind)
 {
     switch (kind) {
       case Bailout_Normal:
         return "Bailout_Normal";
       case Bailout_ArgumentCheck:
         return "Bailout_ArgumentCheck";
-      case Bailout_TypeBarrier:
-        return "Bailout_TypeBarrier";
-      case Bailout_Monitor:
-        return "Bailout_Monitor";
       case Bailout_BoundsCheck:
         return "Bailout_BoundsCheck";
       case Bailout_ShapeGuard:
         return "Bailout_ShapeGuard";
-      case Bailout_CachedShapeGuard:
-        return "Bailout_CachedShapeGuard";
+      case Bailout_BaselineInfo:
+        return "Bailout_BaselineInfo";
       default:
         MOZ_ASSUME_UNREACHABLE("Invalid BailoutKind");
     }
 }
 #endif
 
 // The ordering of this enumeration is important: Anything < Value is a
 // specialized type. Furthermore, anything < String has trivial conversion to
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -1060,17 +1060,17 @@ LIRGenerator::lowerShiftOp(JSOp op, MShi
     if (lhs->type() == MIRType_Int32 && rhs->type() == MIRType_Int32) {
         if (ins->type() == MIRType_Double) {
             JS_ASSERT(op == JSOP_URSH);
             return lowerUrshD(ins->toUrsh());
         }
 
         LShiftI *lir = new LShiftI(op);
         if (op == JSOP_URSH) {
-            if (ins->toUrsh()->fallible() && !assignSnapshot(lir))
+            if (ins->toUrsh()->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
         }
         return lowerForShift(lir, ins, lhs, rhs);
     }
 
     JS_ASSERT(ins->specialization() == MIRType_None);
 
     if (op == JSOP_URSH) {
@@ -1262,17 +1262,17 @@ LIRGenerator::visitAdd(MAdd *ins)
 
     JS_ASSERT(lhs->type() == rhs->type());
 
     if (ins->specialization() == MIRType_Int32) {
         JS_ASSERT(lhs->type() == MIRType_Int32);
         ReorderCommutative(&lhs, &rhs);
         LAddI *lir = new LAddI;
 
-        if (ins->fallible() && !assignSnapshot(lir))
+        if (ins->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
 
         if (!lowerForALU(lir, ins, lhs, rhs))
             return false;
 
         MaybeSetRecoversInput(ins, lir);
         return true;
     }
@@ -1987,38 +1987,38 @@ LIRGenerator::visitTypeBarrier(MTypeBarr
     DebugOnly<MIRType> outputType = ins->type();
 
     JS_ASSERT(inputType == outputType);
 
     // Handle typebarrier that will always bail.
     // (Emit LBail for visibility).
     if (ins->alwaysBails()) {
         LBail *bail = new LBail();
-        if (!assignSnapshot(bail, ins->bailoutKind()))
+        if (!assignSnapshot(bail))
             return false;
         return redefine(ins, ins->input()) && add(bail, ins);
     }
 
     // Handle typebarrier with Value as input.
     if (inputType == MIRType_Value) {
         LDefinition tmp = needTemp ? temp() : tempToUnbox();
         LTypeBarrierV *barrier = new LTypeBarrierV(tmp);
         if (!useBox(barrier, LTypeBarrierV::Input, ins->input()))
             return false;
-        if (!assignSnapshot(barrier, ins->bailoutKind()))
+        if (!assignSnapshot(barrier))
             return false;
         return redefine(ins, ins->input()) && add(barrier, ins);
     }
 
     // Handle typebarrier with specific TypeObject/SingleObjects.
     if (inputType == MIRType_Object && !types->hasType(types::Type::AnyObjectType()))
     {
         LDefinition tmp = needTemp ? temp() : LDefinition::BogusTemp();
         LTypeBarrierO *barrier = new LTypeBarrierO(useRegister(ins->getOperand(0)), tmp);
-        if (!assignSnapshot(barrier, ins->bailoutKind()))
+        if (!assignSnapshot(barrier))
             return false;
         return redefine(ins, ins->getOperand(0)) && add(barrier, ins);
     }
 
     // Handle remaining cases: No-op, unbox did everything.
     return redefine(ins, ins->getOperand(0));
 }
 
@@ -2611,40 +2611,40 @@ LIRGenerator::visitGetPropertyCache(MGet
 
 bool
 LIRGenerator::visitGetPropertyPolymorphic(MGetPropertyPolymorphic *ins)
 {
     JS_ASSERT(ins->obj()->type() == MIRType_Object);
 
     if (ins->type() == MIRType_Value) {
         LGetPropertyPolymorphicV *lir = new LGetPropertyPolymorphicV(useRegister(ins->obj()));
-        return assignSnapshot(lir, Bailout_CachedShapeGuard) && defineBox(lir, ins);
+        return assignSnapshot(lir, Bailout_ShapeGuard) && defineBox(lir, ins);
     }
 
     LDefinition maybeTemp = (ins->type() == MIRType_Double) ? temp() : LDefinition::BogusTemp();
     LGetPropertyPolymorphicT *lir = new LGetPropertyPolymorphicT(useRegister(ins->obj()), maybeTemp);
-    return assignSnapshot(lir, Bailout_CachedShapeGuard) && define(lir, ins);
+    return assignSnapshot(lir, Bailout_ShapeGuard) && define(lir, ins);
 }
 
 bool
 LIRGenerator::visitSetPropertyPolymorphic(MSetPropertyPolymorphic *ins)
 {
     JS_ASSERT(ins->obj()->type() == MIRType_Object);
 
     if (ins->value()->type() == MIRType_Value) {
         LSetPropertyPolymorphicV *lir = new LSetPropertyPolymorphicV(useRegister(ins->obj()), temp());
         if (!useBox(lir, LSetPropertyPolymorphicV::Value, ins->value()))
             return false;
-        return assignSnapshot(lir, Bailout_CachedShapeGuard) && add(lir, ins);
+        return assignSnapshot(lir, Bailout_ShapeGuard) && add(lir, ins);
     }
 
     LAllocation value = useRegisterOrConstant(ins->value());
     LSetPropertyPolymorphicT *lir =
         new LSetPropertyPolymorphicT(useRegister(ins->obj()), value, ins->value()->type(), temp());
-    return assignSnapshot(lir, Bailout_CachedShapeGuard) && add(lir, ins);
+    return assignSnapshot(lir, Bailout_ShapeGuard) && add(lir, ins);
 }
 
 bool
 LIRGenerator::visitGetElementCache(MGetElementCache *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
 
     if (ins->type() == MIRType_Value) {
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -638,21 +638,19 @@ MGoto::New(MBasicBlock *target)
 }
 
 static void
 PrintBailoutKind(FILE *fp, BailoutKind bailoutKind)
 {
     switch(bailoutKind) {
       case Bailout_Normal: fprintf(fp, "(normal)"); break;
       case Bailout_ArgumentCheck: fprintf(fp, "(args)"); break;
-      case Bailout_TypeBarrier: fprintf(fp, "(typebarrier)"); break;
-      case Bailout_Monitor: fprintf(fp, "(monitor)"); break;
       case Bailout_BoundsCheck: fprintf(fp, "(boundscheck)"); break;
       case Bailout_ShapeGuard: fprintf(fp, "(shapeguard)"); break;
-      case Bailout_CachedShapeGuard: fprintf(fp, "(cached shapeguard)"); break;
+      case Bailout_BaselineInfo: fprintf(fp, "(baseline info)"); break;
       default: break;
     }
 }
 
 void
 MUnbox::printOpcode(FILE *fp) const
 {
     PrintOpcodeName(fp, op());
@@ -670,34 +668,25 @@ MUnbox::printOpcode(FILE *fp) const
     }
 
     switch (mode()) {
       case Fallible: fprintf(fp, " (fallible)"); break;
       case Infallible: fprintf(fp, " (infallible)"); break;
       case TypeBarrier: fprintf(fp, " (typebarrier)"); break;
       default: break;
     }
-
-    if (mode() == Infallible)
-        return;
-
-    fprintf(fp, " ");
-    PrintBailoutKind(fp, bailoutKind());
 }
 
 void
 MTypeBarrier::printOpcode(FILE *fp) const
 {
     PrintOpcodeName(fp, op());
     fprintf(fp, " ");
     getOperand(0)->printName(fp);
-    fprintf(fp, " ");
-
-    PrintBailoutKind(fp, bailoutKind());
- }
+}
  
 void
 MPhi::removeOperand(size_t index)
 {
     MUse *use = getUseFor(index);
 
     JS_ASSERT(index < inputs_.length());
     JS_ASSERT(inputs_.length() > 1);
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2265,20 +2265,17 @@ class MUnbox : public MUnaryInstruction,
             setGuard();
 
         bailoutKind_ = kind;
     }
   public:
     INSTRUCTION_HEADER(Unbox)
     static MUnbox *New(MDefinition *ins, MIRType type, Mode mode)
     {
-        BailoutKind kind = Bailout_Normal;
-        if (mode == TypeBarrier && ins->isEffectful())
-            kind = Bailout_TypeBarrier;
-        return new MUnbox(ins, type, mode, kind);
+        return new MUnbox(ins, type, mode, Bailout_Normal);
     }
 
     static MUnbox *New(MDefinition *ins, MIRType type, Mode mode, BailoutKind kind)
     {
         return new MUnbox(ins, type, mode, kind);
     }
 
     TypePolicy *typePolicy() {
@@ -7916,56 +7913,45 @@ class MGuardThreadLocalObject
 };
 
 // Given a value, guard that the value is in a particular TypeSet, then returns
 // that value.
 class MTypeBarrier
   : public MUnaryInstruction,
     public TypeBarrierPolicy
 {
-    BailoutKind bailoutKind_;
-
-    MTypeBarrier(MDefinition *def, types::TemporaryTypeSet *types, BailoutKind bailoutKind)
+    MTypeBarrier(MDefinition *def, types::TemporaryTypeSet *types)
       : MUnaryInstruction(def)
     {
         JS_ASSERT(!types->unknown());
 
         MIRType type = MIRTypeFromValueType(types->getKnownTypeTag());
         setResultType(type);
         setResultTypeSet(types);
 
         setGuard();
         setMovable();
-        bailoutKind_ = bailoutKind;
     }
 
   public:
     INSTRUCTION_HEADER(TypeBarrier)
 
     static MTypeBarrier *New(MDefinition *def, types::TemporaryTypeSet *types) {
-        BailoutKind kind = def->isEffectful() ? Bailout_TypeBarrier : Bailout_Normal;
-        return new MTypeBarrier(def, types, kind);
-    }
-    static MTypeBarrier *New(MDefinition *def, types::TemporaryTypeSet *types,
-                             BailoutKind kind) {
-        return new MTypeBarrier(def, types, kind);
+        return new MTypeBarrier(def, types);
     }
 
     void printOpcode(FILE *fp) const;
 
     TypePolicy *typePolicy() {
         return this;
     }
 
     bool congruentTo(MDefinition *def) const {
         return false;
     }
-    BailoutKind bailoutKind() const {
-        return bailoutKind_;
-    }
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
     virtual bool neverHoist() const {
         return resultTypeSet()->empty();
     }
 
     bool alwaysBails() const {
--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@@ -273,18 +273,17 @@ TypeBarrierPolicy::adjustInputs(MInstruc
         JS_ASSERT(outputType != MIRType_Value);
 
         // We can't unbox a value to null/undefined. So keep output also a value.
         if (IsNullOrUndefined(outputType) || outputType == MIRType_Magic) {
             ins->setResultType(MIRType_Value);
             return true;
         }
 
-        MUnbox *unbox = MUnbox::New(ins->getOperand(0), outputType,
-                                    MUnbox::TypeBarrier, ins->bailoutKind());
+        MUnbox *unbox = MUnbox::New(ins->getOperand(0), outputType, MUnbox::TypeBarrier);
         ins->block()->insertBefore(ins, unbox);
         ins->replaceOperand(0, unbox);
         return true;
     }
 
     // In the remaining cases we will alway bail. OutputType doesn't matter.
     // Take inputType so we can use redefine during lowering.
     JS_ASSERT(ins->alwaysBails());
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -51,19 +51,18 @@ InvokeFunction(JSContext *cx, HandleObje
     if (obj->is<JSFunction>()) {
         RootedFunction fun(cx, &obj->as<JSFunction>());
         if (fun->isInterpreted()) {
             if (fun->isInterpretedLazy() && !fun->getOrCreateScript(cx))
                 return false;
 
             // Clone function at call site if needed.
             if (fun->nonLazyScript()->shouldCloneAtCallsite) {
-                RootedScript script(cx);
                 jsbytecode *pc;
-                types::TypeScript::GetPcScript(cx, script.address(), &pc);
+                RootedScript script(cx, cx->currentScript(&pc));
                 fun = CloneFunctionAtCallsite(cx, fun, script, pc);
                 if (!fun)
                     return false;
             }
         }
     }
 
     // Data in the argument vector is arranged for a JIT -> JIT call.
@@ -78,19 +77,18 @@ InvokeFunction(JSContext *cx, HandleObje
         if (!InvokeConstructor(cx, ObjectValue(*obj), argc, argvWithoutThis, rv.address()))
             return false;
     } else {
         if (!Invoke(cx, thisv, ObjectValue(*obj), argc, argvWithoutThis, &rv))
             return false;
     }
 
     if (obj->is<JSFunction>()) {
-        RootedScript script(cx);
         jsbytecode *pc;
-        types::TypeScript::GetPcScript(cx, script.address(), &pc);
+        RootedScript script(cx, cx->currentScript(&pc));
         types::TypeScript::Monitor(cx, script, pc, rv.get());
     }
 
     *rval = rv;
     return true;
 }
 
 JSObject *
--- a/js/src/jit/arm/Lowering-arm.cpp
+++ b/js/src/jit/arm/Lowering-arm.cpp
@@ -272,79 +272,79 @@ LIRGeneratorARM::lowerDivI(MDiv *div)
         // Check for division by a positive power of two, which is an easy and
         // important case to optimize. Note that other optimizations are also
         // possible; division by negative powers of two can be optimized in a
         // similar manner as positive powers of two, and division by other
         // constants can be optimized by a reciprocal multiplication technique.
         int32_t shift = FloorLog2(rhs);
         if (rhs > 0 && 1 << shift == rhs) {
             LDivPowTwoI *lir = new LDivPowTwoI(useRegisterAtStart(div->lhs()), shift);
-            if (div->fallible() && !assignSnapshot(lir))
+            if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
             return define(lir, div);
         }
     }
 
     if (hasIDIV()) {
         LDivI *lir = new LDivI(useRegister(div->lhs()), useRegister(div->rhs()), temp());
-        if (div->fallible() && !assignSnapshot(lir))
+        if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return define(lir, div);
-    } else {
-        LSoftDivI *lir = new LSoftDivI(useFixed(div->lhs(), r0), use(div->rhs(), r1),
-                                       tempFixed(r2), tempFixed(r3));
-        if (div->fallible() && !assignSnapshot(lir))
-            return false;
-        return defineFixed(lir, div, LAllocation(AnyRegister(r0)));
     }
+
+    LSoftDivI *lir = new LSoftDivI(useFixed(div->lhs(), r0), use(div->rhs(), r1),
+                                   tempFixed(r2), tempFixed(r3));
+    if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
+        return false;
+    return defineFixed(lir, div, LAllocation(AnyRegister(r0)));
 }
 
 bool
 LIRGeneratorARM::lowerMulI(MMul *mul, MDefinition *lhs, MDefinition *rhs)
 {
     LMulI *lir = new LMulI;
-    if (mul->fallible() && !assignSnapshot(lir))
+    if (mul->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return lowerForALU(lir, mul, lhs, rhs);
 }
 
 bool
 LIRGeneratorARM::lowerModI(MMod *mod)
 {
     if (mod->isUnsigned())
         return lowerUMod(mod);
 
     if (mod->rhs()->isConstant()) {
         int32_t rhs = mod->rhs()->toConstant()->value().toInt32();
         int32_t shift = FloorLog2(rhs);
         if (rhs > 0 && 1 << shift == rhs) {
             LModPowTwoI *lir = new LModPowTwoI(useRegister(mod->lhs()), shift);
-            if (mod->fallible() && !assignSnapshot(lir))
+            if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
             return define(lir, mod);
         } else if (shift < 31 && (1 << (shift+1)) - 1 == rhs) {
             LModMaskI *lir = new LModMaskI(useRegister(mod->lhs()), temp(LDefinition::GENERAL), shift+1);
-            if (mod->fallible() && !assignSnapshot(lir))
+            if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
             return define(lir, mod);
         }
     }
 
     if (hasIDIV()) {
         LModI *lir = new LModI(useRegister(mod->lhs()), useRegister(mod->rhs()), temp());
-        if (mod->fallible() && !assignSnapshot(lir))
+        if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return define(lir, mod);
-    } else {
-        LSoftModI *lir = new LSoftModI(useFixed(mod->lhs(), r0), use(mod->rhs(), r1),
-                                       tempFixed(r2), tempFixed(r3), temp(LDefinition::GENERAL));
-        if (mod->fallible() && !assignSnapshot(lir))
-            return false;
-        return defineFixed(lir, mod, LAllocation(AnyRegister(r1)));
     }
+
+    LSoftModI *lir = new LSoftModI(useFixed(mod->lhs(), r0), use(mod->rhs(), r1),
+                                   tempFixed(r2), tempFixed(r3), temp(LDefinition::GENERAL));
+    if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
+        return false;
+    return defineFixed(lir, mod, LAllocation(AnyRegister(r1)));
 }
 
 bool
 LIRGeneratorARM::visitPowHalf(MPowHalf *ins)
 {
     MDefinition *input = ins->input();
     JS_ASSERT(input->type() == MIRType_Double);
     LPowHalfD *lir = new LPowHalfD(useRegisterAtStart(input));
--- a/js/src/jit/shared/Lowering-x86-shared.cpp
+++ b/js/src/jit/shared/Lowering-x86-shared.cpp
@@ -116,17 +116,17 @@ LIRGeneratorX86Shared::lowerForBitAndAnd
 }
 
 bool
 LIRGeneratorX86Shared::lowerMulI(MMul *mul, MDefinition *lhs, MDefinition *rhs)
 {
     // Note: lhs is used twice, so that we can restore the original value for the
     // negative zero check.
     LMulI *lir = new LMulI(useRegisterAtStart(lhs), useOrConstant(rhs), use(lhs));
-    if (mul->fallible() && !assignSnapshot(lir))
+    if (mul->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return defineReuseInput(lir, mul, 0);
 }
 
 bool
 LIRGeneratorX86Shared::lowerDivI(MDiv *div)
 {
     if (div->isUnsigned())
@@ -140,17 +140,17 @@ LIRGeneratorX86Shared::lowerDivI(MDiv *d
         // Check for division by a positive power of two, which is an easy and
         // important case to optimize. Note that other optimizations are also
         // possible; division by negative powers of two can be optimized in a
         // similar manner as positive powers of two, and division by other
         // constants can be optimized by a reciprocal multiplication technique.
         int32_t shift = FloorLog2(rhs);
         if (rhs > 0 && 1 << shift == rhs) {
             LDivPowTwoI *lir = new LDivPowTwoI(useRegisterAtStart(div->lhs()), useRegister(div->lhs()), shift);
-            if (div->fallible() && !assignSnapshot(lir))
+            if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
             return defineReuseInput(lir, div, 0);
         }
     }
 
     // Optimize x/x. This is quaint, but it also protects the LDivI code below.
     // Since LDivI requires lhs to be in %eax, and since the register allocator
     // can't put a virtual register in two physical registers at the same time,
@@ -158,45 +158,45 @@ LIRGeneratorX86Shared::lowerDivI(MDiv *d
     // would conflict with the %eax output register. (rhs could be marked
     // usedAtStart but for the fact that LDivI clobbers %edx early and rhs could
     // happen to be in %edx).
     if (div->lhs() == div->rhs()) {
         if (!div->canBeDivideByZero())
             return define(new LInteger(1), div);
 
         LDivSelfI *lir = new LDivSelfI(useRegisterAtStart(div->lhs()));
-        if (div->fallible() && !assignSnapshot(lir))
+        if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return define(lir, div);
     }
 
     LDivI *lir = new LDivI(useFixed(div->lhs(), eax), useRegister(div->rhs()), tempFixed(edx));
-    if (div->fallible() && !assignSnapshot(lir))
+    if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return defineFixed(lir, div, LAllocation(AnyRegister(eax)));
 }
 
 bool
 LIRGeneratorX86Shared::lowerModI(MMod *mod)
 {
     if (mod->isUnsigned())
         return lowerUMod(mod);
 
     if (mod->rhs()->isConstant()) {
         int32_t rhs = mod->rhs()->toConstant()->value().toInt32();
         int32_t shift = FloorLog2(rhs);
         if (rhs > 0 && 1 << shift == rhs) {
             LModPowTwoI *lir = new LModPowTwoI(useRegisterAtStart(mod->lhs()), shift);
-            if (mod->fallible() && !assignSnapshot(lir))
+            if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
             return defineReuseInput(lir, mod, 0);
         }
     }
     LModI *lir = new LModI(useRegister(mod->lhs()), useRegister(mod->rhs()), tempFixed(eax));
-    if (mod->fallible() && !assignSnapshot(lir))
+    if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return defineFixed(lir, mod, LAllocation(AnyRegister(edx)));
 }
 
 bool
 LIRGeneratorX86Shared::visitAsmJSNeg(MAsmJSNeg *ins)
 {
     if (ins->type() == MIRType_Int32)
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -2875,66 +2875,16 @@ CheckNewScriptProperties(JSContext *cx, 
 #endif // JS_ION
 }
 
 /////////////////////////////////////////////////////////////////////
 // Interface functions
 /////////////////////////////////////////////////////////////////////
 
 void
-types::MarkIteratorUnknownSlow(JSContext *cx)
-{
-    /* Check whether we are actually at an ITER opcode. */
-
-    jsbytecode *pc;
-    RootedScript script(cx, cx->currentScript(&pc));
-    if (!script || !pc)
-        return;
-
-    if (JSOp(*pc) != JSOP_ITER)
-        return;
-
-    AutoEnterAnalysis enter(cx);
-
-    if (!script->ensureHasTypes(cx))
-        return;
-
-    /*
-     * This script is iterating over an actual Iterator or Generator object, or
-     * an object with a custom __iterator__ hook. In such cases 'for in' loops
-     * can produce values other than strings, and the types of the ITER opcodes
-     * in the script need to be updated. During analysis this is done with the
-     * forTypes in the analysis state, but we don't keep a pointer to this type
-     * set and need to scan the script to fix affected opcodes.
-     */
-
-    TypeResult *result = script->types->dynamicList;
-    while (result) {
-        if (result->offset == UINT32_MAX) {
-            /* Already know about custom iterators used in this script. */
-            JS_ASSERT(result->type.isUnknown());
-            return;
-        }
-        result = result->next;
-    }
-
-    InferSpew(ISpewOps, "externalType: customIterator #%u", script->id());
-
-    result = cx->new_<TypeResult>(UINT32_MAX, Type::UnknownType());
-    if (!result) {
-        cx->compartment()->types.setPendingNukeTypes(cx);
-        return;
-    }
-    result->next = script->types->dynamicList;
-    script->types->dynamicList = result;
-
-    AddPendingRecompile(cx, script);
-}
-
-void
 types::TypeMonitorCallSlow(JSContext *cx, JSObject *callee, const CallArgs &args,
                            bool constructing)
 {
     unsigned nargs = callee->as<JSFunction>().nargs;
     JSScript *script = callee->as<JSFunction>().nonLazyScript();
 
     if (!constructing)
         TypeScript::SetThis(cx, script, args.thisv());
@@ -2959,71 +2909,16 @@ IsAboutToBeFinalized(TypeObjectKey *key)
     /* Mask out the low bit indicating whether this is a type or JS object. */
     gc::Cell *tmp = reinterpret_cast<gc::Cell *>(uintptr_t(key) & ~1);
     bool isAboutToBeFinalized = IsCellAboutToBeFinalized(&tmp);
     JS_ASSERT(tmp == reinterpret_cast<gc::Cell *>(uintptr_t(key) & ~1));
     return isAboutToBeFinalized;
 }
 
 void
-types::TypeDynamicResult(JSContext *cx, JSScript *script, jsbytecode *pc, Type type)
-{
-    JS_ASSERT(cx->typeInferenceEnabled());
-
-    if (!script->types)
-        return;
-
-    AutoEnterAnalysis enter(cx);
-
-    /* Directly update associated type sets for applicable bytecodes. */
-    if (js_CodeSpec[*pc].format & JOF_TYPESET) {
-        if (!script->ensureHasBytecodeTypeMap(cx)) {
-            cx->compartment()->types.setPendingNukeTypes(cx);
-            return;
-        }
-        TypeSet *types = TypeScript::BytecodeTypes(script, pc);
-        if (!types->hasType(type)) {
-            InferSpew(ISpewOps, "externalType: monitorResult #%u:%05u: %s",
-                      script->id(), pc - script->code, TypeString(type));
-            types->addType(cx, type);
-        }
-        return;
-    }
-
-    /* Scan all intermediate types on the script to check for a dupe. */
-    TypeResult *result, **pstart = &script->types->dynamicList, **presult = pstart;
-    while (*presult) {
-        result = *presult;
-        if (result->offset == unsigned(pc - script->code) && result->type == type) {
-            if (presult != pstart) {
-                /* Move to the head of the list, maintain LRU order. */
-                *presult = result->next;
-                result->next = *pstart;
-                *pstart = result;
-            }
-            return;
-        }
-        presult = &result->next;
-    }
-
-    InferSpew(ISpewOps, "externalType: monitorResult #%u:%05u: %s",
-              script->id(), pc - script->code, TypeString(type));
-
-    result = cx->new_<TypeResult>(pc - script->code, type);
-    if (!result) {
-        cx->compartment()->types.setPendingNukeTypes(cx);
-        return;
-    }
-    result->next = script->types->dynamicList;
-    script->types->dynamicList = result;
-
-    AddPendingRecompile(cx, script);
-}
-
-void
 types::TypeMonitorResult(JSContext *cx, JSScript *script, jsbytecode *pc, const js::Value &rval)
 {
     /* Allow the non-TYPESET scenario to simplify stubs used in compound opcodes. */
     if (!(js_CodeSpec[*pc].format & JOF_TYPESET))
         return;
 
     if (!script->types)
         return;
@@ -3907,47 +3802,26 @@ TypeScript::Sweep(FreeOp *fop, JSScript 
 
     unsigned num = NumTypeSets(script);
     TypeSet *typeArray = script->types->typeArray();
 
     /* Remove constraints and references to dead objects from the persistent type sets. */
     for (unsigned i = 0; i < num; i++)
         typeArray[i].sweep(compartment->zone());
 
-    TypeResult **presult = &script->types->dynamicList;
-    while (*presult) {
-        TypeResult *result = *presult;
-        Type type = result->type;
-
-        if (!type.isUnknown() && !type.isAnyObject() && type.isObject() &&
-            IsAboutToBeFinalized(type.objectKey()))
-        {
-            *presult = result->next;
-            fop->delete_(result);
-        } else {
-            presult = &result->next;
-        }
-    }
-
     /*
      * Freeze constraints on stack type sets need to be regenerated the next
      * time the script is analyzed.
      */
     script->hasFreezeConstraints = false;
 }
 
 void
 TypeScript::destroy()
 {
-    while (dynamicList) {
-        TypeResult *next = dynamicList->next;
-        js_delete(dynamicList);
-        dynamicList = next;
-    }
-
     js_free(this);
 }
 
 /* static */ void
 TypeScript::AddFreezeConstraints(JSContext *cx, JSScript *script)
 {
     if (script->hasFreezeConstraints)
         return;
@@ -3990,22 +3864,16 @@ SizeOfScriptTypeInferenceData(JSScript *
 
     /* If TI is disabled, a single TypeScript is still present. */
     if (!script->compartment()->zone()->types.inferenceEnabled) {
         sizes->typeScripts += mallocSizeOf(typeScript);
         return;
     }
 
     sizes->typeScripts += mallocSizeOf(typeScript);
-
-    TypeResult *result = typeScript->dynamicList;
-    while (result) {
-        sizes->typeResults += mallocSizeOf(result);
-        result = result->next;
-    }
 }
 
 void
 Zone::sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf, size_t *typePool)
 {
     *typePool += types.typeLifoAlloc.sizeOfExcludingThis(mallocSizeOf);
 }
 
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -713,33 +713,16 @@ TypeSet::toHeapSet()
 
 bool
 AddClearDefiniteGetterSetterForPrototypeChain(JSContext *cx, TypeObject *type, jsid id);
 
 void
 AddClearDefiniteFunctionUsesInScript(JSContext *cx, TypeObject *type,
                                      JSScript *script, JSScript *calleeScript);
 
-/*
- * Handler which persists information about dynamic types pushed within a
- * script which can affect its behavior and are not covered by JOF_TYPESET ops,
- * such as integer operations which overflow to a double. These persist across
- * GCs, and are used to re-seed script types when they are reanalyzed.
- */
-struct TypeResult
-{
-    uint32_t offset;
-    Type type;
-    TypeResult *next;
-
-    TypeResult(uint32_t offset, Type type)
-        : offset(offset), type(type), next(NULL)
-    {}
-};
-
 /* Is this a reasonable PC to be doing inlining on? */
 inline bool isInlinableCall(jsbytecode *pc);
 
 /* Type information about a property. */
 struct Property
 {
     /* Identifier for this property, JSID_VOID for the aggregate integer index property. */
     HeapId id;
@@ -1154,19 +1137,16 @@ class TypeScript
 
     /*
      * List mapping indexes of bytecode type sets to the offset of the opcode
      * they correspond to. Cleared on each GC.
      */
     uint32_t *bytecodeMap;
 
   public:
-    /* Dynamic types generated at points within this script. */
-    TypeResult *dynamicList;
-
     /*
      * Array of type sets storing the possible inputs to property reads.
      * Generated the first time the script is analyzed by inference and kept
      * after analysis purges.
      */
     HeapTypeSet *propertyReadTypes;
 
     /* Array of type type sets for variables and JOF_TYPESET ops. */
@@ -1183,29 +1163,16 @@ class TypeScript
     /* Get the default 'new' object for a given standard class, per the script's global. */
     static inline TypeObject *StandardType(JSContext *cx, JSProtoKey kind);
 
     /* Get a type object for an allocation site in this script. */
     static inline TypeObject *InitObject(JSContext *cx, JSScript *script, jsbytecode *pc,
                                          JSProtoKey kind);
 
     /*
-     * Monitor a bytecode pushing a value which is not accounted for by the
-     * inference type constraints, such as integer overflow.
-     */
-    static inline void MonitorOverflow(JSContext *cx, JSScript *script, jsbytecode *pc);
-    static inline void MonitorString(JSContext *cx, JSScript *script, jsbytecode *pc);
-    static inline void MonitorUnknown(JSContext *cx, JSScript *script, jsbytecode *pc);
-
-    static inline void GetPcScript(JSContext *cx, JSScript **script, jsbytecode **pc);
-    static inline void MonitorOverflow(JSContext *cx);
-    static inline void MonitorString(JSContext *cx);
-    static inline void MonitorUnknown(JSContext *cx);
-
-    /*
      * Monitor a bytecode pushing any value. This must be called for any opcode
      * which is JOF_TYPESET, and where either the script has not been analyzed
      * by type inference or where the pc has type barriers. For simplicity, we
      * always monitor JOF_TYPESET opcodes in the interpreter and stub calls,
      * and only look at barriers when generating JIT code for the script.
      */
     static inline void Monitor(JSContext *cx, JSScript *script, jsbytecode *pc,
                                const js::Value &val);
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -495,27 +495,16 @@ GetTypeCallerInitObject(JSContext *cx, J
         if (script)
             return TypeScript::InitObject(cx, script, pc, key);
     }
     return GetTypeNewObject(cx, key);
 }
 
 void MarkIteratorUnknownSlow(JSContext *cx);
 
-/*
- * When using a custom iterator within the initialization of a 'for in' loop,
- * mark the iterator values as unknown.
- */
-inline void
-MarkIteratorUnknown(JSContext *cx)
-{
-    if (cx->typeInferenceEnabled())
-        MarkIteratorUnknownSlow(cx);
-}
-
 void TypeMonitorCallSlow(JSContext *cx, JSObject *callee, const CallArgs &args,
                          bool constructing);
 
 /*
  * Monitor a javascript call, either on entry to the interpreter or made
  * from within the interpreter.
  */
 inline void
@@ -834,75 +823,20 @@ SetInitializerObjectType(JSContext *cx, 
 /* static */ inline void
 TypeScript::Monitor(JSContext *cx, JSScript *script, jsbytecode *pc, const js::Value &rval)
 {
     if (cx->typeInferenceEnabled())
         TypeMonitorResult(cx, script, pc, rval);
 }
 
 /* static */ inline void
-TypeScript::MonitorOverflow(JSContext *cx, JSScript *script, jsbytecode *pc)
-{
-    if (cx->typeInferenceEnabled())
-        TypeDynamicResult(cx, script, pc, Type::DoubleType());
-}
-
-/* static */ inline void
-TypeScript::MonitorString(JSContext *cx, JSScript *script, jsbytecode *pc)
-{
-    if (cx->typeInferenceEnabled())
-        TypeDynamicResult(cx, script, pc, Type::StringType());
-}
-
-/* static */ inline void
-TypeScript::MonitorUnknown(JSContext *cx, JSScript *script, jsbytecode *pc)
-{
-    if (cx->typeInferenceEnabled())
-        TypeDynamicResult(cx, script, pc, Type::UnknownType());
-}
-
-/* static */ inline void
-TypeScript::GetPcScript(JSContext *cx, JSScript **script, jsbytecode **pc)
-{
-    *script = cx->currentScript(pc);
-}
-
-/* static */ inline void
-TypeScript::MonitorOverflow(JSContext *cx)
-{
-    RootedScript script(cx);
-    jsbytecode *pc;
-    GetPcScript(cx, script.address(), &pc);
-    MonitorOverflow(cx, script, pc);
-}
-
-/* static */ inline void
-TypeScript::MonitorString(JSContext *cx)
-{
-    RootedScript script(cx);
-    jsbytecode *pc;
-    GetPcScript(cx, script.address(), &pc);
-    MonitorString(cx, script, pc);
-}
-
-/* static */ inline void
-TypeScript::MonitorUnknown(JSContext *cx)
-{
-    RootedScript script(cx);
-    jsbytecode *pc;
-    GetPcScript(cx, script.address(), &pc);
-    MonitorUnknown(cx, script, pc);
-}
-
-/* static */ inline void
 TypeScript::Monitor(JSContext *cx, const js::Value &rval)
 {
-    RootedScript script(cx);
     jsbytecode *pc;
-    GetPcScript(cx, script.address(), &pc);
+    RootedScript script(cx, cx->currentScript(&pc));
     Monitor(cx, script, pc, rval);
 }
 
 /* static */ inline void
 TypeScript::MonitorAssign(JSContext *cx, HandleObject obj, jsid id)
 {
     if (cx->typeInferenceEnabled() && !obj->hasSingletonType()) {
         /*
@@ -1573,30 +1507,16 @@ TypeNewScript::writeBarrierPre(TypeNewSc
     JS::Zone *zone = newScript->fun->zone();
     if (zone->needsBarrier()) {
         MarkObject(zone->barrierTracer(), &newScript->fun, "write barrier");
         MarkShape(zone->barrierTracer(), &newScript->shape, "write barrier");
     }
 #endif
 }
 
-inline bool
-IterationValuesMustBeStrings(JSScript *script)
-{
-    // Return true if no custom non-string-producing iterators have been used
-    // in a 'for in' loop within the script.
-    types::TypeResult *result = script->types->dynamicList;
-    while (result) {
-        if (result->offset == UINT32_MAX)
-            return false;
-        result = result->next;
-    }
-    return true;
-}
-
 } } /* namespace js::types */
 
 inline bool
 JSScript::ensureHasTypes(JSContext *cx)
 {
     return types || makeTypes(cx);
 }
 
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -599,17 +599,16 @@ js::GetIterator(JSContext *cx, HandleObj
     bool keysOnly = (flags == JSITER_ENUMERATE);
 
     if (obj) {
         if (JSIteratorOp op = obj->getClass()->ext.iteratorObject) {
             JSObject *iterobj = op(cx, obj, !(flags & JSITER_FOREACH));
             if (!iterobj)
                 return false;
             vp.setObject(*iterobj);
-            types::MarkIteratorUnknown(cx);
             return true;
         }
 
         if (keysOnly) {
             /*
              * Check to see if this is the same as the most recent object which
              * was iterated over.  We don't explicitly check for shapeless
              * objects here, as they are not inserted into the cache and
@@ -676,26 +675,23 @@ js::GetIterator(JSContext *cx, HandleObj
                     if (shapes.length() == 2)
                         cx->runtime()->nativeIterCache.last = iterobj;
                     return true;
                 }
             }
         }
 
       miss:
-        if (obj->is<ProxyObject>()) {
-            types::MarkIteratorUnknown(cx);
+        if (obj->is<ProxyObject>())
             return Proxy::iterate(cx, obj, flags, vp);
-        }
+
         if (!GetCustomIterator(cx, obj, flags, vp))
             return false;
-        if (!vp.isUndefined()) {
-            types::MarkIteratorUnknown(cx);
+        if (!vp.isUndefined())
             return true;
-        }
     }
 
     /* NB: for (var p in null) succeeds by iterating over no properties. */
 
     AutoIdVector keys(cx);
     if (flags & JSITER_FOREACH) {
         if (JS_LIKELY(obj != NULL) && !Snapshot(cx, obj, flags, &keys))
             return false;
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -2213,19 +2213,18 @@ js_GetScriptLineExtent(JSScript *script)
     return 1 + lineno - script->lineno;
 }
 
 void
 js::CurrentScriptFileLineOrigin(JSContext *cx, const char **file, unsigned *linenop,
                                 JSPrincipals **origin, LineOption opt)
 {
     if (opt == CALLED_FROM_JSOP_EVAL) {
-        JSScript *script = NULL;
         jsbytecode *pc = NULL;
-        types::TypeScript::GetPcScript(cx, &script, &pc);
+        JSScript *script = cx->currentScript(&pc);
         JS_ASSERT(JSOp(*pc) == JSOP_EVAL || JSOp(*pc) == JSOP_SPREADEVAL);
         JS_ASSERT(*(pc + (JSOp(*pc) == JSOP_EVAL ? JSOP_EVAL_LENGTH
                                                  : JSOP_SPREADEVAL_LENGTH)) == JSOP_LINENO);
         *file = script->filename();
         *linenop = GET_UINT16(pc + (JSOp(*pc) == JSOP_EVAL ? JSOP_EVAL_LENGTH
                                                            : JSOP_SPREADEVAL_LENGTH));
         *origin = script->originPrincipals();
         return;
--- a/js/src/vm/Interpreter-inl.h
+++ b/js/src/vm/Interpreter-inl.h
@@ -307,25 +307,22 @@ NegOperation(JSContext *cx, HandleScript
 {
     /*
      * When the operand is int jsval, INT32_FITS_IN_JSVAL(i) implies
      * INT32_FITS_IN_JSVAL(-i) unless i is 0 or INT32_MIN when the
      * results, -0.0 or INT32_MAX + 1, are double values.
      */
     int32_t i;
     if (val.isInt32() && (i = val.toInt32()) != 0 && i != INT32_MIN) {
-        i = -i;
-        res.setInt32(i);
+        res.setInt32(-i);
     } else {
         double d;
         if (!ToNumber(cx, val, &d))
             return false;
-        d = -d;
-        if (!res.setNumber(d) && !val.isDouble())
-            types::TypeScript::MonitorOverflow(cx, script, pc);
+        res.setNumber(-d);
     }
 
     return true;
 }
 
 static JS_ALWAYS_INLINE bool
 ToIdOperation(JSContext *cx, HandleScript script, jsbytecode *pc, HandleValue objval,
               HandleValue idval, MutableHandleValue res)
@@ -339,18 +336,16 @@ ToIdOperation(JSContext *cx, HandleScrip
     if (!obj)
         return false;
 
     RootedId id(cx);
     if (!ValueToId<CanGC>(cx, idval, &id))
         return false;
 
     res.set(IdToValue(id));
-    if (!res.isInt32())
-        types::TypeScript::MonitorUnknown(cx, script, pc);
     return true;
 }
 
 static JS_ALWAYS_INLINE bool
 GetObjectElementOperation(JSContext *cx, JSOp op, JSObject *objArg, bool wasObject,
                           HandleValue rref, MutableHandleValue res)
 {
     do {
@@ -633,26 +628,24 @@ BitRsh(JSContext *cx, HandleValue lhs, H
     int32_t left, right;
     if (!ToInt32(cx, lhs, &left) || !ToInt32(cx, rhs, &right))
         return false;
     *out = left >> (right & 31);
     return true;
 }
 
 static JS_ALWAYS_INLINE bool
-UrshOperation(JSContext *cx, HandleScript script, jsbytecode *pc,
-              HandleValue lhs, HandleValue rhs, Value *out)
+UrshOperation(JSContext *cx, HandleValue lhs, HandleValue rhs, Value *out)
 {
     uint32_t left;
     int32_t  right;
     if (!ToUint32(cx, lhs, &left) || !ToInt32(cx, rhs, &right))
         return false;
     left >>= right & 31;
-    if (!out->setNumber(uint32_t(left)))
-        types::TypeScript::MonitorOverflow(cx, script, pc);
+    out->setNumber(uint32_t(left));
     return true;
 }
 
 #undef RELATIONAL_OP
 
 inline JSFunction *
 ReportIfNotFunction(JSContext *cx, const Value &v, MaybeConstruct construct = NO_CONSTRUCT)
 {
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -182,18 +182,16 @@ bool
 js::OnUnknownMethod(JSContext *cx, HandleObject obj, Value idval_, MutableHandleValue vp)
 {
     RootedValue idval(cx, idval_);
 
     RootedValue value(cx);
     if (!JSObject::getProperty(cx, obj, obj, cx->names().noSuchMethod, &value))
         return false;
 
-    TypeScript::MonitorUnknown(cx);
-
     if (value.isObject()) {
         JSObject *obj = NewObjectWithClassProto(cx, &js_NoSuchMethodClass, nullptr, nullptr);
         if (!obj)
             return false;
 
         obj->setSlot(JSSLOT_FOUND_FUNCTION, value);
         obj->setSlot(JSSLOT_SAVED_ID, idval);
         vp.setObject(*obj);
@@ -1069,37 +1067,30 @@ ComputeImplicitThis(JSContext *cx, Handl
     if (!nobj)
         return false;
 
     vp.setObject(*nobj);
     return true;
 }
 
 static JS_ALWAYS_INLINE bool
-AddOperation(JSContext *cx, HandleScript script, jsbytecode *pc,
-             MutableHandleValue lhs, MutableHandleValue rhs, Value *res)
+AddOperation(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, Value *res)
 {
     if (lhs.isInt32() && rhs.isInt32()) {
         int32_t l = lhs.toInt32(), r = rhs.toInt32();
         double d = double(l) + double(r);
-        if (!res->setNumber(d))
-            types::TypeScript::MonitorOverflow(cx, script, pc);
+        res->setNumber(d);
         return true;
     }
 
-    /*
-     * If either operand is an object, any non-integer result must be
-     * reported to inference.
-     */
-    bool lIsObject = lhs.isObject(), rIsObject = rhs.isObject();
-
     if (!ToPrimitive(cx, lhs))
         return false;
     if (!ToPrimitive(cx, rhs))
         return false;
+
     bool lIsString, rIsString;
     if ((lIsString = lhs.isString()) | (rIsString = rhs.isString())) {
         JSString *lstr, *rstr;
         if (lIsString) {
             lstr = lhs.toString();
         } else {
             lstr = ToString<CanGC>(cx, lhs);
             if (!lstr)
@@ -1117,93 +1108,73 @@ AddOperation(JSContext *cx, HandleScript
         }
         JSString *str = ConcatStrings<NoGC>(cx, lstr, rstr);
         if (!str) {
             RootedString nlstr(cx, lstr), nrstr(cx, rstr);
             str = ConcatStrings<CanGC>(cx, nlstr, nrstr);
             if (!str)
                 return false;
         }
-        if (lIsObject || rIsObject)
-            types::TypeScript::MonitorString(cx, script, pc);
         res->setString(str);
     } else {
         double l, r;
         if (!ToNumber(cx, lhs, &l) || !ToNumber(cx, rhs, &r))
             return false;
-        l += r;
-        Value nres = NumberValue(l);
-        if (nres.isDouble() &&
-            (lIsObject || rIsObject || (!lhs.isDouble() && !rhs.isDouble()))) {
-            types::TypeScript::MonitorOverflow(cx, script, pc);
-        }
-        *res = nres;
+        res->setNumber(l + r);
     }
 
     return true;
 }
 
 static JS_ALWAYS_INLINE bool
-SubOperation(JSContext *cx, HandleScript script, jsbytecode *pc, HandleValue lhs, HandleValue rhs,
-             Value *res)
+SubOperation(JSContext *cx, HandleValue lhs, HandleValue rhs, Value *res)
 {
     double d1, d2;
     if (!ToNumber(cx, lhs, &d1) || !ToNumber(cx, rhs, &d2))
         return false;
-    double d = d1 - d2;
-    if (!res->setNumber(d) && !(lhs.isDouble() || rhs.isDouble()))
-        types::TypeScript::MonitorOverflow(cx, script, pc);
+    res->setNumber(d1 - d2);
     return true;
 }
 
 static JS_ALWAYS_INLINE bool
-MulOperation(JSContext *cx, HandleScript script, jsbytecode *pc, HandleValue lhs, HandleValue rhs,
-             Value *res)
+MulOperation(JSContext *cx, HandleValue lhs, HandleValue rhs, Value *res)
 {
     double d1, d2;
     if (!ToNumber(cx, lhs, &d1) || !ToNumber(cx, rhs, &d2))
         return false;
-    double d = d1 * d2;
-    if (!res->setNumber(d) && !(lhs.isDouble() || rhs.isDouble()))
-        types::TypeScript::MonitorOverflow(cx, script, pc);
+    res->setNumber(d1 * d2);
     return true;
 }
 
 static JS_ALWAYS_INLINE bool
-DivOperation(JSContext *cx, HandleScript script, jsbytecode *pc, HandleValue lhs, HandleValue rhs,
-             Value *res)
+DivOperation(JSContext *cx, HandleValue lhs, HandleValue rhs, Value *res)
 {
     double d1, d2;
     if (!ToNumber(cx, lhs, &d1) || !ToNumber(cx, rhs, &d2))
         return false;
     res->setNumber(NumberDiv(d1, d2));
-
-    if (d2 == 0 || (res->isDouble() && !(lhs.isDouble() || rhs.isDouble())))
-        types::TypeScript::MonitorOverflow(cx, script, pc);
     return true;
 }
 
 static JS_ALWAYS_INLINE bool
-ModOperation(JSContext *cx, HandleScript script, jsbytecode *pc, HandleValue lhs, HandleValue rhs,
-             Value *res)
+ModOperation(JSContext *cx, HandleValue lhs, HandleValue rhs, Value *res)
 {
     int32_t l, r;
     if (lhs.isInt32() && rhs.isInt32() &&
         (l = lhs.toInt32()) >= 0 && (r = rhs.toInt32()) > 0) {
         int32_t mod = l % r;
         res->setInt32(mod);
         return true;
     }
 
     double d1, d2;
     if (!ToNumber(cx, lhs, &d1) || !ToNumber(cx, rhs, &d2))
         return false;
 
     res->setNumber(NumberMod(d1, d2));
-    types::TypeScript::MonitorOverflow(cx, script, pc);
     return true;
 }
 
 static JS_ALWAYS_INLINE bool
 SetObjectElementOperation(JSContext *cx, Handle<JSObject*> obj, HandleId id, const Value &value,
                           bool strict, JSScript *script = nullptr, jsbytecode *pc = nullptr)
 {
     types::TypeScript::MonitorAssign(cx, obj, id);
@@ -2061,71 +2032,71 @@ BEGIN_CASE(JSOP_RSH)
 END_CASE(JSOP_RSH)
 
 #undef SIGNED_SHIFT_OP
 
 BEGIN_CASE(JSOP_URSH)
 {
     HandleValue lval = regs.stackHandleAt(-2);
     HandleValue rval = regs.stackHandleAt(-1);
-    if (!UrshOperation(cx, script, regs.pc, lval, rval, &regs.sp[-2]))
+    if (!UrshOperation(cx, lval, rval, &regs.sp[-2]))
         goto error;
     regs.sp--;
 }
 END_CASE(JSOP_URSH)
 
 BEGIN_CASE(JSOP_ADD)
 {
     MutableHandleValue lval = regs.stackHandleAt(-2);
     MutableHandleValue rval = regs.stackHandleAt(-1);
-    if (!AddOperation(cx, script, regs.pc, lval, rval, &regs.sp[-2]))
+    if (!AddOperation(cx, lval, rval, &regs.sp[-2]))
         goto error;
     regs.sp--;
 }
 END_CASE(JSOP_ADD)
 
 BEGIN_CASE(JSOP_SUB)
 {
     RootedValue &lval = rootValue0, &rval = rootValue1;
     lval = regs.sp[-2];
     rval = regs.sp[-1];
-    if (!SubOperation(cx, script, regs.pc, lval, rval, &regs.sp[-2]))
+    if (!SubOperation(cx, lval, rval, &regs.sp[-2]))
         goto error;
     regs.sp--;
 }
 END_CASE(JSOP_SUB)
 
 BEGIN_CASE(JSOP_MUL)
 {
     RootedValue &lval = rootValue0, &rval = rootValue1;
     lval = regs.sp[-2];
     rval = regs.sp[-1];
-    if (!MulOperation(cx, script, regs.pc, lval, rval, &regs.sp[-2]))
+    if (!MulOperation(cx, lval, rval, &regs.sp[-2]))
         goto error;
     regs.sp--;
 }
 END_CASE(JSOP_MUL)
 
 BEGIN_CASE(JSOP_DIV)
 {
     RootedValue &lval = rootValue0, &rval = rootValue1;
     lval = regs.sp[-2];
     rval = regs.sp[-1];
-    if (!DivOperation(cx, script, regs.pc, lval, rval, &regs.sp[-2]))
+    if (!DivOperation(cx, lval, rval, &regs.sp[-2]))
         goto error;
     regs.sp--;
 }
 END_CASE(JSOP_DIV)
 
 BEGIN_CASE(JSOP_MOD)
 {
     RootedValue &lval = rootValue0, &rval = rootValue1;
     lval = regs.sp[-2];
     rval = regs.sp[-1];
-    if (!ModOperation(cx, script, regs.pc, lval, rval, &regs.sp[-2]))
+    if (!ModOperation(cx, lval, rval, &regs.sp[-2]))
         goto error;
     regs.sp--;
 }
 END_CASE(JSOP_MOD)
 
 BEGIN_CASE(JSOP_NOT)
 {
     bool cond = ToBooleanOp(regs);
@@ -2152,18 +2123,16 @@ BEGIN_CASE(JSOP_NEG)
     if (!NegOperation(cx, script, regs.pc, val, res))
         goto error;
 }
 END_CASE(JSOP_NEG)
 
 BEGIN_CASE(JSOP_POS)
     if (!ToNumber(cx, regs.stackHandleAt(-1)))
         goto error;
-    if (!regs.sp[-1].isInt32())
-        TypeScript::MonitorOverflow(cx, script, regs.pc);
 END_CASE(JSOP_POS)
 
 BEGIN_CASE(JSOP_DELNAME)
 {
     /* Strict mode code should never contain JSOP_DELNAME opcodes. */
     JS_ASSERT(!script->strict);
 
     RootedPropertyName &name = rootName0;
@@ -3734,61 +3703,49 @@ js::SetObjectElement(JSContext *cx, Hand
 
 bool
 js::InitElementArray(JSContext *cx, jsbytecode *pc, HandleObject obj, uint32_t index, HandleValue value)
 {
     return InitArrayElemOperation(cx, pc, obj, index, value);
 }
 
 bool
-js::AddValues(JSContext *cx, HandleScript script, jsbytecode *pc,
-              MutableHandleValue lhs, MutableHandleValue rhs,
-              Value *res)
+js::AddValues(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, Value *res)
 {
-    return AddOperation(cx, script, pc, lhs, rhs, res);
+    return AddOperation(cx, lhs, rhs, res);
 }
 
 bool
-js::SubValues(JSContext *cx, HandleScript script, jsbytecode *pc,
-              MutableHandleValue lhs, MutableHandleValue rhs,
-              Value *res)
+js::SubValues(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, Value *res)
 {
-    return SubOperation(cx, script, pc, lhs, rhs, res);
+    return SubOperation(cx, lhs, rhs, res);
 }
 
 bool
-js::MulValues(JSContext *cx, HandleScript script, jsbytecode *pc,
-              MutableHandleValue lhs, MutableHandleValue rhs,
-              Value *res)
+js::MulValues(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, Value *res)
 {
-    return MulOperation(cx, script, pc, lhs, rhs, res);
+    return MulOperation(cx, lhs, rhs, res);
 }
 
 bool
-js::DivValues(JSContext *cx, HandleScript script, jsbytecode *pc,
-              MutableHandleValue lhs, MutableHandleValue rhs,
-              Value *res)
+js::DivValues(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, Value *res)
 {
-    return DivOperation(cx, script, pc, lhs, rhs, res);
+    return DivOperation(cx, lhs, rhs, res);
 }
 
 bool
-js::ModValues(JSContext *cx, HandleScript script, jsbytecode *pc,
-              MutableHandleValue lhs, MutableHandleValue rhs,
-              Value *res)
+js::ModValues(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, Value *res)
 {
-    return ModOperation(cx, script, pc, lhs, rhs, res);
+    return ModOperation(cx, lhs, rhs, res);
 }
 
 bool
-js::UrshValues(JSContext *cx, HandleScript script, jsbytecode *pc,
-               MutableHandleValue lhs, MutableHandleValue rhs,
-               Value *res)
+js::UrshValues(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, Value *res)
 {
-    return UrshOperation(cx, script, pc, lhs, rhs, res);
+    return UrshOperation(cx, lhs, rhs, res);
 }
 
 bool
 js::DeleteNameOperation(JSContext *cx, HandlePropertyName name, HandleObject scopeObj,
                         MutableHandleValue res)
 {
     RootedObject scope(cx), pobj(cx);
     RootedShape shape(cx);
--- a/js/src/vm/Interpreter.h
+++ b/js/src/vm/Interpreter.h
@@ -377,44 +377,32 @@ bool
 SetObjectElement(JSContext *cx, HandleObject obj, HandleValue index, HandleValue value,
                  bool strict, HandleScript script, jsbytecode *pc);
 
 bool
 InitElementArray(JSContext *cx, jsbytecode *pc,
                  HandleObject obj, uint32_t index, HandleValue value);
 
 bool
-AddValues(JSContext *cx, HandleScript script, jsbytecode *pc,
-          MutableHandleValue lhs, MutableHandleValue rhs,
-          Value *res);
+AddValues(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, Value *res);
 
 bool
-SubValues(JSContext *cx, HandleScript script, jsbytecode *pc,
-          MutableHandleValue lhs, MutableHandleValue rhs,
-          Value *res);
+SubValues(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, Value *res);
 
 bool
-MulValues(JSContext *cx, HandleScript script, jsbytecode *pc,
-          MutableHandleValue lhs, MutableHandleValue rhs,
-          Value *res);
+MulValues(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, Value *res);
 
 bool
-DivValues(JSContext *cx, HandleScript script, jsbytecode *pc,
-          MutableHandleValue lhs, MutableHandleValue rhs,
-          Value *res);
+DivValues(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, Value *res);
 
 bool
-ModValues(JSContext *cx, HandleScript script, jsbytecode *pc,
-          MutableHandleValue lhs, MutableHandleValue rhs,
-          Value *res);
+ModValues(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, Value *res);
 
 bool
-UrshValues(JSContext *cx, HandleScript script, jsbytecode *pc,
-           MutableHandleValue lhs, MutableHandleValue rhs,
-           Value *res);
+UrshValues(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, Value *res);
 
 template <bool strict>
 bool
 SetProperty(JSContext *cx, HandleObject obj, HandleId id, const Value &value);
 
 template <bool strict>
 bool
 DeleteProperty(JSContext *ctx, HandleValue val, HandlePropertyName name, bool *bv);
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -2131,20 +2131,16 @@ ReportCompartmentStats(const JS::Compart
     ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("objects/malloc-heap/ctypes-data"),
                    cStats.objectsExtra.mallocHeapCtypesData,
                    "Memory allocated on the malloc heap for data belonging to ctypes objects.");
 
     ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/type-scripts"),
                    cStats.typeInference.typeScripts,
                    "Memory used by type sets associated with scripts.");
 
-    ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/type-results"),
-                   cStats.typeInference.typeResults,
-                   "Memory used by dynamic type results produced by scripts.");
-
     ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/pending-arrays"),
                    cStats.typeInference.pendingArrays,
                    "Memory used for solving constraints during type inference.");
 
     ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/allocation-site-tables"),
                    cStats.typeInference.allocationSiteTables,
                    "Memory indexing type objects associated with allocation sites.");