From c97017cd5794cc436e7b0bdbebd49da8b16d018e Mon Sep 17 00:00:00 2001
From: Pale Moon <git-repo@palemoon.org>
Date: Wed, 16 Nov 2016 17:57:05 +0100
Subject: [PATCH] Bug 1299519.

---
 js/src/frontend/Parser.cpp      |  6 ++++--
 js/src/frontend/SharedContext.h | 14 ++++++++++++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 590969d726..7f0cbdb492 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -7096,8 +7096,10 @@ Parser<ParseHandler>::generatorComprehensionLambda(GeneratorKind comprehensionKi
      * kid and could be removed from pc->sc.
      */
     genFunbox->anyCxFlags = outerpc->sc->anyCxFlags;
-    if (outerpc->sc->isFunctionBox())
-        genFunbox->funCxFlags = outerpc->sc->asFunctionBox()->funCxFlags;
+    if (outerpc->sc->isFunctionBox()) {
+        genFunbox->funCxFlags =
+            outerpc->sc->asFunctionBox()->flagsForNestedGeneratorComprehensionLambda();
+    }
 
     MOZ_ASSERT(genFunbox->generatorKind() == comprehensionKind);
     genFunbox->inGenexpLambda = true;
diff --git a/js/src/frontend/SharedContext.h b/js/src/frontend/SharedContext.h
index 6a1e7cb4aa..fa429c0cde 100644
--- a/js/src/frontend/SharedContext.h
+++ b/js/src/frontend/SharedContext.h
@@ -126,6 +126,16 @@ class FunctionContextFlags
     //
     bool definitelyNeedsArgsObj:1;
 
+    FunctionContextFlags flagsForNestedGeneratorComprehensionLambda() const {
+        FunctionContextFlags flags;
+        flags.mightAliasLocals = mightAliasLocals;
+        flags.hasExtensibleScope = false;
+        flags.needsDeclEnvObject = false;
+        flags.argumentsHasLocalBinding = false;
+        flags.definitelyNeedsArgsObj = false;
+        return flags;
+    }
+
   public:
     FunctionContextFlags()
      :  mightAliasLocals(false),
@@ -299,6 +309,10 @@ class FunctionBox : public ObjectBox, public SharedContext
     void setDefinitelyNeedsArgsObj()       { MOZ_ASSERT(funCxFlags.argumentsHasLocalBinding);
                                              funCxFlags.definitelyNeedsArgsObj   = true; }
 
+    FunctionContextFlags flagsForNestedGeneratorComprehensionLambda() const {
+        return funCxFlags.flagsForNestedGeneratorComprehensionLambda();
+    }
+
     bool hasDefaults() const {
         return length != function()->nargs() - function()->hasRest();
     }