Fix hard-case destructurinv vs. for(var ...=... in ...) bug (558633, r=mrbkap, a=dveditz).
authorBrendan Eich <brendan@mozilla.org>
Thu, 20 Jan 2011 15:48:18 -0800
changeset 27307 6e7c740fdcb57446475eb3a0bfd98ce943e39eaf
parent 27306 2c0131a3e7d774e51c281da15f64a5739f69daef
child 27308 83f3261717134c4b0b4517e66c811db35916b9d6
push id2647
push userjwalden@mit.edu
push dateFri, 21 Jan 2011 19:40:32 +0000
reviewersmrbkap, dveditz
bugs558633
milestone1.9.1.17pre
Fix hard-case destructurinv vs. for(var ...=... in ...) bug (558633, r=mrbkap, a=dveditz).
js/src/jsparse.cpp
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -3459,17 +3459,23 @@ BindDestructuringLHS(JSContext *cx, JSPa
 
     switch (pn->pn_type) {
       case TOK_NAME:
         NoteLValue(cx, pn, tc);
         /* FALL THROUGH */
 
       case TOK_DOT:
       case TOK_LB:
-        pn->pn_op = JSOP_SETNAME;
+        /*
+         * We may be called on a name node that has already been specialized,
+         * in the very weird and ECMA-262-required "for (var [x] = i in o) ..."
+         * case. See bug 558633.
+         */
+        if (!(js_CodeSpec[pn->pn_op].format & JOF_SET))
+            pn->pn_op = JSOP_SETNAME;
         break;
 
 #if JS_HAS_LVALUE_RETURN
       case TOK_LP:
         if (!MakeSetCall(cx, pn, tc, JSMSG_BAD_LEFTSIDE_OF_ASS))
             return JS_FALSE;
         break;
 #endif