Bug 515885 - Assertion failure: !scope->owned(), at ../jsobj.cpp. r=brendan.

This commit is contained in:
Jason Orendorff 2009-10-23 14:35:53 -05:00
parent efdbb8da44
commit e66886b51c
3 changed files with 8 additions and 2 deletions

View File

@ -6625,8 +6625,7 @@ ComprehensionTail(JSParseNode *kid, uintN blockid, JSTreeContext *tc,
pn2->pn_kid = kid;
*pnp = pn2;
if (type == TOK_ARRAYPUSH)
PopStatement(tc);
PopStatement(tc);
return pn;
}

View File

@ -79,3 +79,4 @@ script regress-496922.js
script regress-507053.js
script regress-507295.js
script regress-507424.js
script regress-515885.js

View File

@ -0,0 +1,6 @@
// Any copyright is dedicated to the Public Domain.
// http://creativecommons.org/licenses/publicdomain/
var it = (x for (x in [function(){}]));
it.next();
reportCompare("no assertion failure", "no assertion failure", "See bug 515885.");