Bug 515885 - Assertion failure: !scope->owned(), at ../jsobj.cpp. r=brendan.
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -6592,18 +6592,17 @@ ComprehensionTail(JSParseNode *kid, uint
pn2 = NewParseNode(PN_UNARY, tc);
if (!pn2)
return NULL;
pn2->pn_type = type;
pn2->pn_op = op;
pn2->pn_kid = kid;
*pnp = pn2;
- if (type == TOK_ARRAYPUSH)
- PopStatement(tc);
+ PopStatement(tc);
return pn;
}
#if JS_HAS_GENERATOR_EXPRS
/*
* Starting from a |for| keyword after an expression, parse the comprehension
* tail completing this generator expression. Wrap the expression at kid in a
--- a/js/src/tests/js1_8_1/regress/jstests.list
+++ b/js/src/tests/js1_8_1/regress/jstests.list
@@ -74,8 +74,9 @@ script regress-479430-03.js
script regress-479430-04.js
script regress-479430-05.js
script regress-495773.js
script regress-495907.js
script regress-496922.js
script regress-507053.js
script regress-507295.js
script regress-507424.js
+script regress-515885.js
new file mode 100644
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-515885.js
@@ -0,0 +1,6 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+var it = (x for (x in [function(){}]));
+it.next();
+
+reportCompare("no assertion failure", "no assertion failure", "See bug 515885.");