Except for the emergency repair added in bug 933734, the remaining uses of IonBuilder's context member are straightforward to remove. Rather than file bugs for each of these separately this bug collates the various fixes required.

annotateGetPropertyCache and getPropTryCache use a context to allow hashification of shapes which they are searching. These shapes are not in a dictionary though and can be searched linearly from off thread. (Dictionary shapes can't be searched linearly while off thread because their next/prev pointers might change).

Several APIs for interacting with aliasedvar scope coordinates take a context, which is only used to construct an unnecessary root inside StaticScopeIters. This patch makes StaticScopeIter a template class like Shape::Range which either does or doesn't require a context.

This patch uses Ion's temp allocator for allocating the TypeRepresentationSet optionally created (fixing a leak in the process, since IonBuilders aren't explicitly destroyed). TypeRepresentationSet doesn't release any other data in its destructor.

When compiling JSOP_REGEXP IonBuilder gets the RegExp prototype from the global, but this will never need to create this prototype lazily since there is a regexp literal whose prototype is the object being searched for.

Change inlining of PJS natives to not force instantiation of constructor intrinsic functions, and store the ParallelArrayObject template in baseline caches, as is done for other natives.

The math cache will be instantiated the first time a math function is called so there is no need for IonBuilder to force its instantiation.

Remove an unnecessary Handle requirement on ArrayPrototypeHasIndexedProperty.

ToNumber can have side effects and should never be called by IonBuilder.

Comment on attachment 827446 [details] [diff] [review] PJS changes Review of attachment 827446 [details] [diff] [review]: ----------------------------------------------------------------- Looks good to me.

Part A: https://hg.mozilla.org/integration/mozilla-inbound/rev/3982cd8d5cd3

Here's another intrinsic creating template objects which I missed yesterday.

Part B: https://hg.mozilla.org/integration/mozilla-inbound/rev/b90da019d6d2