Merge. Nothing to see here. Move along.

js/src/jstracer.cpp

@@ -4127,8 +4127,9 @@ TraceRecorder::forInLoop(LIns*& id_ins)
     jsval stateval = iterobj->fslots[JSSLOT_ITER_STATE];
     LIns* stateval_ins = stobj_get_fslot(iterobj_ins, JSSLOT_ITER_STATE);
 
-    // If a guarded condition is false while recording, stack unboxed false
+    // If a guarded loop termination condition is false while recording, stack
-    // and return so the immediately subsequent JSOP_IFEQ exits the loop.
+    // unboxed false and return so the immediately subsequent JSOP_IFEQ exits
+    // the loop.
     int flag = 0;
     id_ins = NULL;
 
@@ -4152,6 +4153,11 @@ TraceRecorder::forInLoop(LIns*& id_ins)
 
     JSNativeEnumerator* ne;
 
+    // Stack an unboxed true to make JSOP_IFEQ loop continue, even if ne is
+    // exhausted. Either we'll end up in the interpreter finding no enumerable
+    // prototype properties, or we will re-enter this trace having gone up the
+    // prototype chain one level.
+    flag = 1;
     ne = (JSNativeEnumerator*) (stateval & ~jsval(3));
     if (ne->cursor == 0)
         goto done;
@@ -4168,8 +4174,6 @@ TraceRecorder::forInLoop(LIns*& id_ins)
                             lir->ins2i(LIR_lsh, cursor_ins, (sizeof(jsid) == 4) ? 2 : 3));
 
 
-    // Stack an unboxed true to make JSOP_IFEQ loop.
-    flag = 1;
     id_ins = lir->insLoadi(id_addr_ins, 0);
 done:
     stack(0, lir->insImm(flag));

js/src/trace-test.js

@@ -658,6 +658,48 @@ function missingArgTest() {
 missingArgTest.expected = "1"
 test(missingArgTest);
 
+JSON = function () {
+    return {
+        stringify: function stringify(value, whitelist) {
+            switch (typeof(value)) {
+              case "object":
+                return value.constructor.name;
+            }
+        }
+    };
+}();
+
+function missingArgTest2() {
+  var testPairs = [
+    ["{}", {}],
+    ["[]", []],
+    ['{"foo":"bar"}', {"foo":"bar"}],
+  ]
+  
+  var a = [];
+  for (var i=0; i < testPairs.length; i++) {
+    var s = JSON.stringify(testPairs[i][1])
+    a[i] = s;
+  }
+  return a.join(",");
+}
+missingArgTest2.expected = "Object,Array,Object";
+test(missingArgTest2);
+
+function deepForInLoop() {
+  // NB: the number of props set in C is arefully tuned to match HOTLOOP = 2.
+  function C(){this.p = 1, this.q = 2}
+  C.prototype = {p:1, q:2, r:3, s:4, t:5};
+  var o = new C;
+  var j = 0;
+  var a = [];
+  for (var i in o)
+    a[j++] = i;
+  return a.join("");
+}
+deepForInLoop.expected = "pqrst";
+test(deepForInLoop);
+
 /* Keep these at the end so that we can see the summary after the trace-debug spew. */
 print("\npassed:", passes.length && passes.join(","));
 print("\nFAILED:", fails.length && fails.join(","));