Fix register allocation around inline returns, bug 713209.

js/src/methodjit/FrameState-inl.h

@@ -1125,8 +1125,10 @@ FrameState::frameSlot(ActiveFrame *a, const FrameEntry *fe) const
 }
 
 inline JSC::MacroAssembler::Address
-FrameState::addressForInlineReturn() const
+FrameState::addressForInlineReturn()
 {
+    if (a->callee_->isTracked())
+        discardFe(a->callee_);
     return addressOf(a->callee_);
 }
 

js/src/methodjit/FrameState.h

@@ -877,7 +877,7 @@ class FrameState
     Address addressForDataRemat(const FrameEntry *fe) const;
 
     // Inside an inline frame, the address for the return value in the caller.
-    Address addressForInlineReturn() const;
+    Address addressForInlineReturn();
 
     inline StateRemat dataRematInfo(const FrameEntry *fe) const;