Fix trashing of inner trees. Keep track of trees that call to a tree and flush them as well since they directly embed the code address. Since flushing an inner tree might invalidate the tree we are currently compiling, trees are now trashed in the destructor of TraceRecorder.

js/src/jsbuiltins.cpp

@@ -424,6 +424,7 @@ js_CallTree(InterpState* state, Fragment* f)
 {
     union { NIns *code; GuardRecord* (FASTCALL *func)(InterpState*, Fragment*); } u;
     u.code = f->code();
+    JS_ASSERT(u.code);
     return u.func(state, NULL);
 }