Bug 520323 - Using a Fragment in RecordTree after flush (r=gal)

--HG--
extra : rebase_source : a8beacaaffe96268db3dd61e886a702a4c54fc28

js/src/jstracer.cpp

@@ -5521,9 +5521,12 @@ RecordTree(JSContext* cx, JSTraceMonitor* tm, VMFragment* f, jsbytecode* outer,
 {
     JS_ASSERT(f->root == f);
 
+    /* save a local copy for use after JIT flush */
+    const void* localRootIP = f->root->ip;
+
     /* Make sure the global type map didn't change on us. */
     if (!CheckGlobalObjectShape(cx, tm, globalObj)) {
-        Backoff(cx, (jsbytecode*) f->root->ip);
+        Backoff(cx, (jsbytecode*) localRootIP);
         return false;
     }