[INFER] Fix merge botches.

js/src/jsinfer.cpp

@@ -157,6 +157,8 @@ static bool InferSpewActive(SpewChannel channel)
     return active[channel];
 }
 
+#ifdef DEBUG
+
 static bool InferSpewColorable()
 {
     /* Only spew colors on xterm-color to not screw up emacs. */
@@ -166,8 +168,6 @@ static bool InferSpewColorable()
     return strcmp(env, "xterm-color") == 0;
 }
 
-#ifdef DEBUG
-
 const char *
 types::InferSpewColorReset()
 {

js/src/jsobj.h

@@ -636,12 +636,15 @@ struct JSObject : js::gc::Cell {
 
     inline size_t numFixedSlots() const;
 
-  private:
-    inline js::Value* fixedSlots() const;
+    /* Whether this object has any dynamic slots at all. */
     inline bool hasSlotsArray() const;
 
+    /* Get the number of dynamic slots required for a given capacity. */
     inline size_t numDynamicSlots(size_t capacity) const;
 
+  private:
+    inline js::Value* fixedSlots() const;
+
   public:
     /* Minimum size for dynamically allocated slots. */
     static const uint32 SLOT_CAPACITY_MIN = 8;

js/src/methodjit/MethodJIT-inl.h

@@ -83,6 +83,9 @@ CanMethodJIT(JSContext *cx, JSScript *script, StackFrame *fp, CompileRequest req
 static inline bool
 RecursiveMethodJIT(JSContext *cx, StackFrame *fp)
 {
+    if (!cx->compartment->hasJaegerCompartment())
+        return false;
+
     /*
      * We can recursively enter the method JIT on a single stack frame by
      * taking back edges, compiling, getting kicked back into the interpreter

js/src/xpconnect/src/xpcjsruntime.cpp

@@ -1341,7 +1341,7 @@ GetJSObjectSlotsCallback(JSContext *cx, void *v, size_t traceKind, void *thing)
     JSObject *obj = (JSObject *)thing;
     if (obj->hasSlotsArray()) {
         PRInt64Data *data = (PRInt64Data *) v;
-        data->n += obj->numSlots() * sizeof(js::Value);
+        data->n += obj->numDynamicSlots(obj->numSlots()) * sizeof(js::Value);
     }
 }
 #ifdef _MSC_VER