Issue #1691 - Part 14: Fix a debug assert and memory leak. PNK_IMPORT_META and PNK_CALL_IMPORT are binary nodes... They function similar to list nodes, so they worked there, but debug mode asserts because of the wrong type. https://bugzilla.mozilla.org/show_bug.cgi?id=1342012 Fixed a memory leak due to missing code in SourceScriptObject::finalize(). Thanks FranklinDM!

(cherry picked from commit 15e81193c692c2c2aec665e7e5a88d98a9b85eca)

js/src/frontend/ParseNode.cpp

@@ -293,6 +293,8 @@ PushNodeChildren(ParseNode* pn, NodeStack* stack)
       case PNK_SETTHIS:
       case PNK_FOR:
       case PNK_COMPREHENSIONFOR:
+      case PNK_IMPORT_META:
+      case PNK_CALL_IMPORT:
       case PNK_WITH: {
         BinaryNode* bn = &pn->as<BinaryNode>();
         stack->push(bn->left());
@@ -493,8 +495,6 @@ PushNodeChildren(ParseNode* pn, NodeStack* stack)
       case PNK_EXPORT_SPEC_LIST:
       case PNK_PARAMSBODY:
       case PNK_CLASSMETHODLIST:
-      case PNK_IMPORT_META:
-      case PNK_CALL_IMPORT:
         return PushListNodeChildren(&pn->as<ListNode>(), stack);
 
       // Array comprehension nodes are lists with a single child:

js/src/jsscript.cpp

@@ -1375,6 +1375,16 @@ ScriptSourceObject::finalize(FreeOp* fop, JSObject* obj)
 
     sso->source()->decref();
     sso->setReservedSlot(SOURCE_SLOT, PrivateValue(nullptr));
+
+    Value value = sso->canonicalPrivate();
+    if (!value.isUndefined()) {
+        // The embedding may need to dispose of its private data.
+        JS::AutoSuppressGCAnalysis suppressGC;
+        if (JS::ScriptPrivateFinalizeHook hook =
+            fop->runtime()->scriptPrivateFinalizeHook) {
+                hook(fop, value);
+            }
+    }
 }
 
 static const ClassOps ScriptSourceObjectClassOps = {