From b32bfc9ddd329bbb7df9905ac7dccd07c7a62767 Mon Sep 17 00:00:00 2001
From: "brendan%mozilla.org"
 <brendan%mozilla.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Thu, 22 Feb 2001 07:30:57 +0000
Subject: [PATCH] Fix duplicate parsenode recycle in constant-folded if/else or
 ?: (69607, r=shaver, sr=jband).

git-svn-id: svn://10.0.0.236/trunk@87647 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/js/src/jsparse.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mozilla/js/src/jsparse.c b/mozilla/js/src/jsparse.c
index 40093c72fa3..7a9cc8c51f7 100644
--- a/mozilla/js/src/jsparse.c
+++ b/mozilla/js/src/jsparse.c
@@ -198,6 +198,7 @@ RecycleTree(JSParseNode *pn, JSTreeContext *tc)
 
     if (!pn)
         return;
+    JS_ASSERT(pn != tc->nodeList);      /* catch back-to-back dup recycles */
     switch (pn->pn_arity) {
       case PN_FUNC:
         RecycleTree(pn->pn_body, tc);
@@ -3024,7 +3025,8 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
             pn->pn_kid = NULL;
         }
         RecycleTree(pn2, tc);
-        RecycleTree(pn3, tc);
+        if (pn3 && pn3 != pn2)
+            RecycleTree(pn3, tc);
         break;
 
       case TOK_PLUS: