JM's FrameState should use inferred types of locals, arguments and stack slots to avoid writing, reading, and testing them. Known local types will be written at the start of the frame so they are always in sync, and known stack types will be synced before making a scripted or stub call. A related issue is in avoiding syncs of known argument types when making a scripted call; this is trickier to make sure arguments variable accesses work right, and may be left for another bug.

This patch uses inferred types for local reads/writes, argument reads, numeric operations and call return values (missing: property accesses, including array accesses). Because inference currently disables GC I can't get good SS harness comparisons, but running tests individually gives me a 15ms speedup (18-20ms on AWFY).

Above patch landed on JM: http://hg.mozilla.org/projects/jaegermonkey/rev/c27c97ee8d81

Bug fix for JSOP_MOD producing negative zero: http://hg.mozilla.org/projects/jaegermonkey/rev/c8d33e4cb418

Fix some overly imprecise types for localinc and arginc: http://hg.mozilla.org/projects/jaegermonkey/rev/30ffdc01adf2

Fix breakage of jsop_this() in strict-mode code: http://hg.mozilla.org/projects/jaegermonkey/rev/7f6416de3937