Fix bug 454266 - js_FillPropertyCache uses the wrong scope's shape sometimes (r=mrbkap).

js/src/jsinterp.cpp

@@ -259,7 +259,7 @@ js_FillPropertyCache(JSContext *cx, JSObject *obj, jsuword kshape,
      * but that is a one-time event and we'll have to miss the old shape and
      * re-fill under the new one.
      */
-    if (!(cs->format & (JOF_SET | JOF_INCDEC)))
+    if (!(cs->format & (JOF_SET | JOF_INCDEC)) && obj == pobj)
         kshape = scope->shape;
 
     khash = PROPERTY_CACHE_HASH_PC(pc, kshape);

js/src/jstracer.cpp

@@ -3356,7 +3356,7 @@ TraceRecorder::test_property_cache_direct_slot(JSObject* obj, LIns* obj_ins, uin
         return true;
     }
 
-    /* Insist if setting on obj being the directly addressed object. */
+    /* If modifying the slot, insist on obj being the directly addressed object. */
     uint32 setflags = (js_CodeSpec[*cx->fp->regs->pc].format & (JOF_SET | JOF_INCDEC));
     if (setflags && obj2 != obj)
         ABORT_TRACE("JOF_SET opcode hit prototype chain");