Fixed a bug where no shape guard was emitted if a property was not found, causing it to remain unseen if added later. Abort in this case instead. (bug 457171, r=brendan)

js/src/jstracer.cpp

@@ -3556,7 +3556,7 @@ TraceRecorder::test_property_cache(JSObject* obj, LIns* obj_ins, JSObject*& obj2
 
             // Use PCVAL_NULL to return "no such property" to our caller.
             pcval = PCVAL_NULL;
-            return true;
+            ABORT_TRACE("failed to find property");
         }
 
         OBJ_DROP_PROPERTY(cx, obj2, prop);