Bug 602413 - Trash them, trash them all! (r=dvander)

--HG--
extra : rebase_source : 730a102cf22ce88a4684c2dd7db64f72af418e38

js/src/jit-test/tests/basic/testBug602413.js

@@ -0,0 +1,45 @@
+var so = [];
+
+function U(unusedV)
+{
+  for (var i = 0; i < so.length; ++i)
+    return false;
+  so.push(0);
+}
+
+function C(v)
+{
+  if (typeof v == "object" || typeof v == "function") {
+    for (var i = 0; i < 10; ++i) {}
+    U(v);
+  }
+}
+
+function exploreProperties(obj)
+{
+  var props = [];
+  for (var o = obj; o; o = Object.getPrototypeOf(o)) {
+    props = props.concat(Object.getOwnPropertyNames(o));
+  }
+  for (var i = 0; i < props.length; ++i) {
+    var p = props[i];
+    try { 
+      var v = obj[p];
+      C(v);
+    } catch(e) { }
+  }
+}
+
+function boom()
+{
+  var a = [];
+  var b = function(){};
+  var c = [{}];
+  exploreProperties(a);
+  exploreProperties(b);
+  exploreProperties(c);
+  exploreProperties(c);
+}
+
+boom();
+

js/src/jstracer.cpp

@@ -5011,7 +5011,7 @@ TraceRecorder::joinEdgesToEntry(TreeFragment* peer_root)
                         trashSelf = true;
                     else
                         whichTreesToTrash.addUnique(uexit->fragment->root);
-                    return;
+                    break;
                 }
                 uexit = uexit->next;
             }