Bug 961741 - Allow shape's parent to be null in postbarrier callback r=terrence

js/src/jit-test/tests/gc/bug-961741.js

@@ -0,0 +1,5 @@
+function r() {
+    for (var x in undefined) {}
+}
+setObjectMetadataCallback(true);
+r();

js/src/vm/Shape.cpp

@@ -1621,6 +1621,7 @@ class InitialShapeSetRef : public BufferableRef
         JSObject *priorMetadata = metadata;
         if (proto.isObject())
             Mark(trc, reinterpret_cast<JSObject**>(&proto), "initialShapes set proto");
+        if (parent)
             Mark(trc, &parent, "initialShapes set parent");
         if (metadata)
             Mark(trc, &metadata, "initialShapes set metadata");