Fix hard-case destructurinv vs. for(var ...=... in ...) bug (558633, r=mrbkap).

js/src/jsparse.cpp

@@ -3599,7 +3599,13 @@ BindDestructuringLHS(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
 
       case TOK_DOT:
       case TOK_LB:
-        pn->pn_op = JSOP_SETNAME;
+        /*
+         * We may be called on a name node that has already been specialized,
+         * in the very weird and ECMA-262-required "for (var [x] = i in o) ..."
+         * case. See bug 558633.
+         */
+        if (!(js_CodeSpec[pn->pn_op].format & JOF_SET))
+            pn->pn_op = JSOP_SETNAME;
         break;
 
       case TOK_LP: