fun->u.i.names is incorrect when a local function shadows an argument (600067, r=jorendorff).

js/src/jsscope.cpp

@@ -169,7 +169,13 @@ PropertyTable::init(JSContext *cx, Shape *lastProp)
         METER(searches);
         METER(initSearches);
         Shape **spp = search(shape.id, true);
-        SHAPE_STORE_PRESERVING_COLLISION(spp, &shape);
+
+        /*
+         * Beware duplicate args and arg vs. var conflicts: the youngest shape
+         * (nearest to lastProp) must win. See bug 600067.
+         */
+        if (!SHAPE_FETCH(spp))
+            SHAPE_STORE_PRESERVING_COLLISION(spp, &shape);
     }
     return true;
 }

js/src/tests/js1_8_5/regress/jstests.list

@@ -45,3 +45,4 @@ script regress-597870.js
 fails-if(!xulRuntime.shell) script regress-597945-1.js
 script regress-597945-2.js
 script regress-598176.js
+script regress-600067.js

js/src/tests/js1_8_5/regress/regress-600067.js

@@ -0,0 +1,16 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+/*
+ * NB: this test hardcodes for the value of PropertyTable::HASH_THRESHOLD (6).
+ */
+
+function s(e) {
+  var a, b, c, d;
+  function e() { }
+}
+
+reportCompare(0, 0, "don't crash");