Fix FrameState::forgetType with eval (bug 598696, r=sstangl).

js/src/methodjit/FrameState-inl.h

@@ -524,7 +524,14 @@ FrameState::syncData(const FrameEntry *fe, Address to, Assembler &masm) const
 inline void
 FrameState::forgetType(FrameEntry *fe)
 {
-    JS_ASSERT(fe->isTypeKnown() && !fe->type.synced());
+    /*
+     * The type may have been forgotten with an intervening storeLocal in the
+     * presence of eval or closed variables. For defense in depth and to make
+     * callers' lives simpler, bail out if the type is not known.
+     */
+    if (!fe->isTypeKnown())
+        return;
+
     syncType(fe, addressOf(fe), masm);
     fe->type.setMemory();
 }

js/src/trace-test/tests/jaeger/bug598696.js

@@ -0,0 +1,6 @@
+function f() {
+  eval();
+  var i = 0;
+  assertEq(++i, 1);
+}
+f();