merge

js/src/jsobjinlines.h

@@ -142,7 +142,7 @@ inline void
 JSObject::voidArrayUnused()
 {
     JS_ASSERT(isArray());
-    fslots[JSSLOT_ARRAY_COUNT] = JSVAL_VOID;
+    fslots[JSSLOT_ARRAY_UNUSED] = JSVAL_VOID;
 }
 
 inline void

js/src/trace-test/tests/basic/bug558530.js

@@ -0,0 +1,14 @@
+// There's no assertEq() here;  the test is just that it doesn't crash.
+(function () {
+    new function () {}
+}());
+[function () {}]
+gc()
+for (z = 0; z < 6; ++z) {
+    x = []
+}
+for (w in [0]) {
+    x._ = w
+}
+gc()
+