js_FreeSlot(cx, scope->object, sprop->slot);
JS_ASSERT(sprop); if (SPROP_HAS_VALID_SLOT(sprop)) js_FreeSlot(cx, scope->object, sprop->slot);
js_DestroyScopeProperty(JSContext *cx, JSScope *scope, JSScopeProperty *sprop){    /*     * Test whether obj was finalized before prop's last dereference.     *     * This can happen when a deleted property is held by a property iterator     * object (which points to obj, keeping obj alive so long as the property     * iterator is reachable).  As soon as the GC finds the iterator to be     * unreachable, it will finalize the iterator, and may also finalize obj,     * in an unpredictable order.  If obj is finalized first, its map will be     * null below, and we need only free prop.     *     * In the more typical case of a property whose last reference (from a     * symbol in obj's scope) goes away before obj is finalized, we must be     * sure to free prop's slot and unlink it from obj's property list.     */    if (scope) {	JS_ASSERT(JS_IS_SCOPE_LOCKED(scope));	if (scope->object) {	    js_FreeSlot(cx, scope->object, sprop->slot);	    *sprop->prevp = sprop->next;	    if (sprop->next)		sprop->next->prevp = sprop->prevp;	    else		scope->proptail = sprop->prevp;	}    }    /* Purge any cached weak links to prop, then free it. */    js_FlushPropertyCacheByProp(cx, (JSProperty *)sprop);    JS_free(cx, sprop);}