Bug 961741 - Allow shape's parent to be null in postbarrier callback r=terrence

js/src/jit-test/tests/gc/bug-961741.js

@@ -0,0 +1,5 @@
+function r() {
+    for (var x in undefined) {}
+}
+setObjectMetadataCallback(true);
+r();

js/src/vm/Shape.cpp

@@ -1621,7 +1621,8 @@ class InitialShapeSetRef : public BufferableRef
         JSObject *priorMetadata = metadata;
         if (proto.isObject())
             Mark(trc, reinterpret_cast<JSObject**>(&proto), "initialShapes set proto");
-        Mark(trc, &parent, "initialShapes set parent");
+        if (parent)
+            Mark(trc, &parent, "initialShapes set parent");
         if (metadata)
             Mark(trc, &metadata, "initialShapes set metadata");
         if (proto == priorProto && parent == priorParent && metadata == priorMetadata)