Fix fun_resolve to avoid resolving hidden properties (locals/params; 382532, r=mrbkap).

js/src/jsfun.c

@@ -1092,6 +1092,15 @@ fun_resolve(JSContext *cx, JSObject *obj, jsval id, uintN flags,
     JSString *str;
     JSAtom *prototypeAtom;
 
+    /*
+     * No need to reflect fun.prototype in 'fun.prototype = ...' or in an
+     * unqualified reference to prototype, which the emitter looks up as a
+     * hidden atom when attempting to bind to a formal parameter or local
+     * variable slot.
+     */
+    if (flags & (JSRESOLVE_ASSIGNING | JSRESOLVE_HIDDEN))
+        return JS_TRUE;
+
     if (!JSVAL_IS_STRING(id))
         return JS_TRUE;
 
@@ -1100,10 +1109,6 @@ fun_resolve(JSContext *cx, JSObject *obj, jsval id, uintN flags,
     if (!fun || !fun->object)
         return JS_TRUE;
 
-    /* No need to reflect fun.prototype in 'fun.prototype = ...'. */
-    if (flags & JSRESOLVE_ASSIGNING)
-        return JS_TRUE;
-
     /*
      * Ok, check whether id is 'prototype' and bootstrap the function object's
      * prototype property.

js/src/jsobj.c

@@ -2956,7 +2956,8 @@ js_LookupHiddenProperty(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,
                         JSProperty **propp)
 {
     return HidePropertyName(cx, &id) &&
-           js_LookupProperty(cx, obj, id, objp, propp);
+           js_LookupPropertyWithFlags(cx, obj, id, JSRESOLVE_HIDDEN,
+                                      objp, propp);
 }
 
 JSScopeProperty *

js/src/jsobj.h

@@ -501,11 +501,15 @@ js_LookupProperty(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,
 
 /*
  * Specialized subroutine that allows caller to preset JSRESOLVE_* flags.
+ * JSRESOLVE_HIDDEN flags hidden function param/local name lookups, just for
+ * internal use by fun_resolve and similar built-ins.
  */
 extern JSBool
 js_LookupPropertyWithFlags(JSContext *cx, JSObject *obj, jsid id, uintN flags,
                            JSObject **objp, JSProperty **propp);
 
+#define JSRESOLVE_HIDDEN        0x8000
+
 extern JS_FRIEND_API(JSBool)
 js_FindProperty(JSContext *cx, jsid id, JSObject **objp, JSObject **pobjp,
                 JSProperty **propp);