From c9643f4003244b495dbbff826abc292ae5760366 Mon Sep 17 00:00:00 2001
From: Brendan Eich <brendan@mozilla.org>
Date: Wed, 19 May 2010 16:25:56 -0700
Subject: [PATCH] Fix hard-case destructurinv vs. for(var ...=... in ...) bug
 (558633, r=mrbkap).

---
 js/src/jsparse.cpp | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/js/src/jsparse.cpp b/js/src/jsparse.cpp
index 594259af8f67..293ad064168c 100644
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -3599,7 +3599,13 @@ BindDestructuringLHS(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
 
       case TOK_DOT:
       case TOK_LB:
-        pn->pn_op = JSOP_SETNAME;
+        /*
+         * We may be called on a name node that has already been specialized,
+         * in the very weird and ECMA-262-required "for (var [x] = i in o) ..."
+         * case. See bug 558633.
+         */
+        if (!(js_CodeSpec[pn->pn_op].format & JOF_SET))
+            pn->pn_op = JSOP_SETNAME;
         break;
 
       case TOK_LP: