Fixed lazy import regression in upvar resolution (bug 535930, r=dmandelin).

js/src/jstracer.cpp

@@ -12126,8 +12126,8 @@ TraceRecorder::upvar(JSScript* script, JSUpvarArray* uva, uintN index, jsval& v)
     jsval& vr = js_GetUpvar(cx, script->staticLevel, cookie);
     v = vr;
 
-    if (known(&vr))
-        return get(&vr);
+    if (LIns* ins = get(&vr))
+        return ins;
 
     /*
      * The upvar is not in the current trace, so get the upvar value exactly as

js/src/trace-test/tests/basic/bug535930.js

@@ -0,0 +1,19 @@
+(function () {
+    p = function () {
+        Set()
+    };
+    var Set = function () {};
+    for (var x = 0; x < 5; x++) {
+        Set = function (z) {
+            return function () {
+                [z]
+            }
+        } (x)
+    }
+})()
+
+/*
+ * bug 535930, mistaknely generated code to GetUpvar and crashed inside the call.
+ * so don't crash.
+ */
+