From 79ea755b7fa1d6842e0f1fd3ddab8ed1d30b539d Mon Sep 17 00:00:00 2001
From: Brian Smith <brian@dbsoft.org>
Date: Mon, 24 Apr 2023 16:01:17 -0500
Subject: [PATCH] Issue #1691 - Part 14: Fix a debug assert and memory leak.
 PNK_IMPORT_META and PNK_CALL_IMPORT are binary nodes... They function similar
 to list nodes, so they worked there, but debug mode asserts because of the
 wrong type. https://bugzilla.mozilla.org/show_bug.cgi?id=1342012 Fixed a
 memory leak due to missing code in SourceScriptObject::finalize(). Thanks
 FranklinDM!

(cherry picked from commit 15e81193c692c2c2aec665e7e5a88d98a9b85eca)
---
 js/src/frontend/ParseNode.cpp |  4 ++--
 js/src/jsscript.cpp           | 10 ++++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/js/src/frontend/ParseNode.cpp b/js/src/frontend/ParseNode.cpp
index f80ae462cd..a19bdfc6eb 100644
--- a/js/src/frontend/ParseNode.cpp
+++ b/js/src/frontend/ParseNode.cpp
@@ -293,6 +293,8 @@ PushNodeChildren(ParseNode* pn, NodeStack* stack)
       case PNK_SETTHIS:
       case PNK_FOR:
       case PNK_COMPREHENSIONFOR:
+      case PNK_IMPORT_META:
+      case PNK_CALL_IMPORT:
       case PNK_WITH: {
         BinaryNode* bn = &pn->as<BinaryNode>();
         stack->push(bn->left());
@@ -493,8 +495,6 @@ PushNodeChildren(ParseNode* pn, NodeStack* stack)
       case PNK_EXPORT_SPEC_LIST:
       case PNK_PARAMSBODY:
       case PNK_CLASSMETHODLIST:
-      case PNK_IMPORT_META:
-      case PNK_CALL_IMPORT:
         return PushListNodeChildren(&pn->as<ListNode>(), stack);
 
       // Array comprehension nodes are lists with a single child:
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index e6308ceb22..ddb33a4de0 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -1375,6 +1375,16 @@ ScriptSourceObject::finalize(FreeOp* fop, JSObject* obj)
 
     sso->source()->decref();
     sso->setReservedSlot(SOURCE_SLOT, PrivateValue(nullptr));
+
+    Value value = sso->canonicalPrivate();
+    if (!value.isUndefined()) {
+        // The embedding may need to dispose of its private data.
+        JS::AutoSuppressGCAnalysis suppressGC;
+        if (JS::ScriptPrivateFinalizeHook hook =
+            fop->runtime()->scriptPrivateFinalizeHook) {
+                hook(fop, value);
+            }
+    }
 }
 
 static const ClassOps ScriptSourceObjectClassOps = {