Fixed assertion when using recursion in a let block (bug 547791, r=gal).

js/src/jsrecursion.cpp

@@ -226,7 +226,7 @@ TraceRecorder::upRecursion()
     unsigned totalSlots = NativeStackSlots(cx, 1);
     unsigned downPostSlots = totalSlots - NativeStackSlots(cx, 0);
     FrameInfo* fi = (FrameInfo*)alloca(sizeof(FrameInfo) + totalSlots * sizeof(TraceType));
-    fi->block = cx->fp->blockChain;
+    fi->block = cx->fp->down->blockChain;
     fi->pc = (jsbytecode*)return_pc;
     fi->imacpc = NULL;
 

js/src/trace-test/tests/basic/testBug547791.js

@@ -0,0 +1,21 @@
+
+function Bext(k) {
+    if (k > 0) {
+        let i = k + 1;
+        if (k == 10) {
+            function x () { i = 2; }
+	}
+        Bext(i - 2);
+        Bext(i - 2);
+    }
+    return 0;
+}
+
+function f() {
+    Bext(12);
+}
+
+f();
+
+/* Don't assert. */
+