Inference allocates more data than needed, and keeps it live as long as the analyzed script is reachable. This needs to get fixed, blocking bug 613221 because this should precede that. For this statement: x = 5; We allocate pretty fat Bytecode structures for each bytecode, entries for each pushed stack values, and a type constraint propagating the value pushed by '5' into the type of 'x'. All into an arena with the same lifetime as the JSScript. We should instead allocate Bytecodes into a different arena destroyed after constraint generation, avoid constructing stack entries where they are trivially determined (constants, GETLOCAL, values popped immediately, etc.) and most type constraints involving such entries. Stack values and type constraints we need to construct still need to live as long as the script (this should be considerably smaller than the current total allocation), and JSScript needs to remember condensed information needed for dynamic type changes and compilation (namely, stack entries pushed by each bytecode and types of any objects or arrays keyed to script bytecodes).

This patch gets things most of the way there. Instead of persisting the data computed by the bytecode analysis (along with a lot of extra inference data), the bytecode analysis runs, is used by inference and is then thrown away. The result of inference is a TypeScript holding type sets for each arg and local, and type sets pushed by each bytecode. Some significant changes: - Types of 'let' variables are totally unknown (though they were always maybe-void earlier, so not much of a deterioration). - Types of stack values are all unknown at branch boundaries in the method JIT. We can quickly determine the type sets pushed by a bytecode but not the entire stack layout at a given point. http://hg.mozilla.org/projects/jaegermonkey/rev/e34606b13041