Bug 883234 - Fix GGC oranges caused by lazy parsing; r=bhackett

Lazy parsing allows a new function clone site to flow into scripts. This site
needs to create its functions tenured.

--HG--
extra : rebase_source : fecc7ff5de3994b0fc8eda01c13b8cd9f00d1d52

js/src/jit-test/tests/auto-regress/bug827821.js

@@ -1,36 +0,0 @@
-// Binary: cache/js-dbg-32-795632f0e4fe-linux
-// Flags: --ion-eager
-//
-
-var lfcode = new Array();
-lfcode.push("3");
-lfcode.push("\
-	gczeal(2);\
-	for (let q = 0; q < 50; ++q) {\
-		var w = \"r\".match(/r/);\
-	}\
-	let (eval) (function  (a) {\
-		Function = gczeal;\
-	})();\
-	// .js\
-");
-lfcode.push(" // .js");
-lfcode.push(" // .js");
-lfcode.push(" // .js");
-while (true) {
-	var file = lfcode.shift(); if (file == undefined) { break; }
-        loadFile(file)
-}
-function loadFile(lfVarx) {
-    try {
-        if (lfVarx.substr(-3) == ".js") {
-	    uneval("foo");
-            switch (lfRunTypeId) {
-                case 3: function newFunc(x) { new Function(x)(); }; newFunc(lfVarx); break;
-                case 4: eval("(function() { " + lfVarx + " })();"); break;
-            }
-        } else if (!isNaN(lfVarx)) {
-            lfRunTypeId = parseInt(lfVarx);
-	}
-    } catch (lfVare) {}
-}

js/src/vm/Interpreter.cpp

@@ -3239,7 +3239,7 @@ js::DefFunOperation(JSContext *cx, HandleScript script, HandleObject scopeChain,
      */
     RootedFunction fun(cx, funArg);
     if (fun->isNative() || fun->environment() != scopeChain) {
-        fun = CloneFunctionObjectIfNotSingleton(cx, fun, scopeChain);
+        fun = CloneFunctionObjectIfNotSingleton(cx, fun, scopeChain, TenuredObject);
         if (!fun)
             return false;
     } else {