Bug 515885 - Assertion failure: !scope->owned(), at ../jsobj.cpp. r=brendan.
authorJason Orendorff <jorendorff@mozilla.com>
Fri, 23 Oct 2009 14:35:53 -0500
changeset 33184 1b0526ca92e4db3837cceec82e26a0e60b3fce54
parent 33183 8ebd9899f7182e4279f51fbfe6ee0f014200ee06
child 33185 390cd393c4d3a02a0b497f508eeeb614db891de2
push id808
push userrsayre@mozilla.com
push dateWed, 25 Nov 2009 10:14:46 +0000
reviewersbrendan
bugs515885
milestone1.9.2b5pre
Bug 515885 - Assertion failure: !scope->owned(), at ../jsobj.cpp. r=brendan.
js/src/jsparse.cpp
js/src/tests/js1_8_1/regress/jstests.list
js/src/tests/js1_8_1/regress/regress-515885.js
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -6592,18 +6592,17 @@ ComprehensionTail(JSParseNode *kid, uint
     pn2 = NewParseNode(PN_UNARY, tc);
     if (!pn2)
         return NULL;
     pn2->pn_type = type;
     pn2->pn_op = op;
     pn2->pn_kid = kid;
     *pnp = pn2;
 
-    if (type == TOK_ARRAYPUSH)
-        PopStatement(tc);
+    PopStatement(tc);
     return pn;
 }
 
 #if JS_HAS_GENERATOR_EXPRS
 
 /*
  * Starting from a |for| keyword after an expression, parse the comprehension
  * tail completing this generator expression. Wrap the expression at kid in a
--- a/js/src/tests/js1_8_1/regress/jstests.list
+++ b/js/src/tests/js1_8_1/regress/jstests.list
@@ -74,8 +74,9 @@ script regress-479430-03.js
 script regress-479430-04.js
 script regress-479430-05.js
 script regress-495773.js
 script regress-495907.js
 script regress-496922.js
 script regress-507053.js
 script regress-507295.js
 script regress-507424.js
+script regress-515885.js
new file mode 100644
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-515885.js
@@ -0,0 +1,6 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+var it = (x for (x in [function(){}]));
+it.next();
+
+reportCompare("no assertion failure", "no assertion failure", "See bug 515885.");