diff --git a/js/src/jit-test/tests/basic/bug831658.js b/js/src/jit-test/tests/basic/bug831658.js
new file mode 100644
index 000000000000..ae7d6a5a13d9
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug831658.js
@@ -0,0 +1,4 @@
+// Don't assert.
+String.prototype.search = evalcx('').String.prototype.search
+x = /./.test()
+''.search(/()/)
diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
index b0f600fc8c2c..df567458b806 100644
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -652,8 +652,7 @@ RegExpCompartment::~RegExpCompartment()
      * RegExpStatics may have prevented a single RegExpShared from
      * being collected during RegExpCompartment::sweep().
      */
-    if (!inUse_.empty()) {
-        PendingSet::Enum e(inUse_);
+    for (PendingSet::Enum e(inUse_); !e.empty(); e.popFront()) {
         RegExpShared *shared = e.front();
         JS_ASSERT(shared->activeUseCount == 0);
         js_delete(shared);