Blacklist a trace if we hit a global shape mismatch. This makes us suck less on date-format-tofte until we find a way to fix the property cache misses.

js/src/jstracer.cpp

@@ -1689,6 +1689,7 @@ js_ExecuteTree(JSContext* cx, Fragment* f, uintN& inlineCallCount)
         AUDIT(globalShapeMismatchAtEntry);
         debug_only(printf("global shape mismatch, flushing tree.\n"));
         js_TrashTree(cx, f);
+        f->blacklist();
         return NULL;
     }