Bug 672892 - CloneLeftHandSide should not also clone the right-hand side. Well sure it sounds obvious when you write it out like that. r=dvander.
authorJason Orendorff <jorendorff@mozilla.com>
Fri, 12 Aug 2011 13:43:21 -0500
changeset 74357 5ca0d6677b2c94da15a7e65d8824f586898d485b
parent 74356 27492e33ad0f4c1a1e070f7224dbe58e750c395e
child 74358 f3f7872db0aef93fcd565ee96a25fb8c8f02179f
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
reviewersdvander
bugs672892
milestone8.0a1
Bug 672892 - CloneLeftHandSide should not also clone the right-hand side. Well sure it sounds obvious when you write it out like that. r=dvander.
js/src/jsparse.cpp
js/src/tests/js1_8_5/regress/jstests.list
js/src/tests/js1_8_5/regress/regress-672892.js
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -4962,24 +4962,26 @@ CloneLeftHandSide(JSParseNode *opn, JSTr
     /* If opn is a definition or use, make pn a use. */
     pn->pn_u.name = opn->pn_u.name;
     pn->pn_op = JSOP_SETNAME;
     if (opn->pn_used) {
         JSDefinition *dn = pn->pn_lexdef;
 
         pn->pn_link = dn->dn_uses;
         dn->dn_uses = pn;
-    } else if (opn->pn_defn) {
-        /* We copied some definition-specific state into pn. Clear it out. */
+    } else {
         pn->pn_expr = NULL;
-        pn->pn_cookie.makeFree();
-        pn->pn_dflags &= ~PND_BOUND;
-        pn->pn_defn = false;
-
-        LinkUseToDef(pn, (JSDefinition *) opn, tc);
+        if (opn->pn_defn) {
+            /* We copied some definition-specific state into pn. Clear it out. */
+            pn->pn_cookie.makeFree();
+            pn->pn_dflags &= ~PND_BOUND;
+            pn->pn_defn = false;
+
+            LinkUseToDef(pn, (JSDefinition *) opn, tc);
+        }
     }
     return pn;
 }
 
 JSParseNode *
 Parser::forStatement()
 {
     JSParseNode *pnseq = NULL;
--- a/js/src/tests/js1_8_5/regress/jstests.list
+++ b/js/src/tests/js1_8_5/regress/jstests.list
@@ -104,12 +104,13 @@ script regress-636364.js
 script regress-640075.js
 script regress-643222.js
 script regress-646820-1.js
 script regress-646820-2.js
 script regress-646820-3.js
 script regress-665355.js
 script regress-666599.js
 script regress-667047.js
+script regress-672892.js
 script regress-673070-1.js
 script regress-673070-2.js
 script regress-673070-3.js
 script regress-675581.js
new file mode 100644
--- /dev/null
+++ b/js/src/tests/js1_8_5/regress/regress-672892.js
@@ -0,0 +1,8 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+with (0)
+    for (var b = 0 in 0)  // don't assert in parser
+	;
+
+reportCompare(0, 0, 'ok');