Backed out changeset f7cff6dd16f1

js/src/jstracer.cpp

@@ -12126,8 +12126,8 @@ TraceRecorder::upvar(JSScript* script, JSUpvarArray* uva, uintN index, jsval& v)
     jsval& vr = js_GetUpvar(cx, script->staticLevel, cookie);
     v = vr;
 
-    if (LIns* ins = get(&vr))
-        return ins;
+    if (known(&vr))
+        return get(&vr);
 
     /*
      * The upvar is not in the current trace, so get the upvar value exactly as

js/src/trace-test/tests/basic/bug535930.js

@@ -1,19 +0,0 @@
-(function () {
-    p = function () {
-        Set()
-    };
-    var Set = function () {};
-    for (var x = 0; x < 5; x++) {
-        Set = function (z) {
-            return function () {
-                [z]
-            }
-        } (x)
-    }
-})()
-
-/*
- * bug 535930, mistaknely generated code to GetUpvar and crashed inside the call.
- * so don't crash.
- */
-