Munge call ops for delete in the code generator instead of the parser because the parser doesn't have enough information to always munge correctly. bug 356693, r=brendan

js/src/jsemit.c

@@ -5711,7 +5711,10 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 #endif
 #if JS_HAS_LVALUE_RETURN
           case TOK_LP:
-            JS_ASSERT(pn2->pn_op == JSOP_SETCALL);
+            if (pn2->pn_op != JSOP_SETCALL) {
+                JS_ASSERT(pn2->pn_op == JSOP_CALL || pn2->pn_op == JSOP_EVAL);
+                pn2->pn_op = JSOP_SETCALL;
+            }
             top = CG_OFFSET(cg);
             if (!js_EmitTree(cx, cg, pn2))
                 return JS_FALSE;

js/src/jsparse.c

@@ -4161,12 +4161,6 @@ UnaryExpr(JSContext *cx, JSTokenStream *ts, JSTreeContext *tc)
         while (pn2->pn_type == TOK_RP)
             pn2 = pn2->pn_kid;
         pn->pn_kid = pn2;
-#if JS_HAS_LVALUE_RETURN
-        if (pn2->pn_type == TOK_LP) {
-            JS_ASSERT(pn2->pn_op == JSOP_CALL || pn2->pn_op == JSOP_EVAL);
-            pn2->pn_op = JSOP_SETCALL;
-        }
-#endif
         break;
 
       case TOK_ERROR: