Backout bug 475048, it causes mochitests to hang.

js/src/jstracer.cpp

@@ -7001,15 +7001,12 @@ JS_REQUIRES_STACK bool
 TraceRecorder::prop(JSObject* obj, LIns* obj_ins, uint32& slot, LIns*& v_ins)
 {
     /*
-     * If the shape of the object matches the global object's shape, we
+     * Can't specialize to assert obj != global, must guard to avoid aliasing
-     * have to guard against aliasing to avoid aliasing stale homes of stacked
+     * stale homes of stacked global variables.
-     * global variables.
      */
-    if (OBJ_SHAPE(obj) == OBJ_SHAPE(globalObj)) {
+    if (obj == globalObj)
-        if (obj == globalObj)
+        ABORT_TRACE("prop op aliases global");
-            ABORT_TRACE("prop op aliases global");
+    guard(false, lir->ins2(LIR_eq, obj_ins, globalObj_ins), MISMATCH_EXIT);
-        guard(false, lir->ins2(LIR_eq, obj_ins, globalObj_ins), MISMATCH_EXIT);
-    }
 
     /*
      * Property cache ensures that we are dealing with an existing property,

js/src/trace-test.js

@@ -4034,19 +4034,6 @@ function testBug474769() {
 testBug474769.expected = 1;
 test(testBug474769);
 
-undeclaredGlobal = -1;
-function testGlobalAliasCheck() {
-    var q;
-    for (var i = 0; i < 10; ++i) {
-        undeclaredGlobal = i;
-        q = this.undeclaredGlobal;
-    }
-    return q;
-}
-testGlobalAliasCheck.expected = 9;
-test(testGlobalAliasCheck);
-delete undeclaredGlobal;
-
 /*****************************************************************************
  *                                                                           *
  *  _____ _   _  _____ ______ _____ _______                                  *