Bug 487538 - bug 487271 left three tests broken in its wake (r=mrbkap).

js/src/jsapi.cpp

@@ -4400,7 +4400,8 @@ JS_CloneFunctionObject(JSContext *cx, JSObject *funobj, JSObject *parent)
         uint32 i = 0, n = uva->length;
         for (; i < n; i++) {
             JSObject *obj = parent;
-            for (uintN skip = UPVAR_FRAME_SKIP(uva->vector[i]); skip != 0; --skip) {
+            int skip = UPVAR_FRAME_SKIP(uva->vector[i]);
+            while (--skip > 0) {
                 if (!obj) {
                     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                                          JSMSG_BAD_CLONE_FUNOBJ_SCOPE);

js/src/jsparse.cpp

@@ -1352,6 +1352,7 @@ MakeDefIntoUse(JSDefinition *dn, JSParseNode *pn, JSAtom *atom, JSTreeContext *t
         pnu->pn_lexdef = (JSDefinition *) pn;
         pn->pn_dflags |= pnu->pn_dflags & (PND_ASSIGNED | PND_FUNARG);
     }
+    pn->pn_dflags |= dn->pn_dflags & (PND_ASSIGNED | PND_FUNARG);
     pn->dn_uses = dn;
 
     dn->pn_defn = false;
@@ -1667,9 +1668,9 @@ FindFunArgs(JSFunctionBox *funbox, int level, JSFunctionBoxQueue *queue)
          * flag only funbox->node and funbox->kids' nodes here.
          */
         if (funbox->tcflags & TCF_FUN_HEAVYWEIGHT) {
-            fn->pn_dflags |= PND_FUNARG;
+            fn->setFunArg();
             for (JSFunctionBox *kid = funbox->kids; kid; kid = kid->siblings)
-                kid->node->pn_dflags |= PND_FUNARG;
+                kid->node->setFunArg();
         }
 
         if (fn->isFunArg()) {
@@ -1689,7 +1690,7 @@ FindFunArgs(JSFunctionBox *funbox, int level, JSFunctionBoxQueue *queue)
                     JSDefinition *lexdep = ALE_DEFN(ale)->resolve();
 
                     if (!lexdep->isFreeVar() && int(lexdep->frameLevel()) <= fnlevel) {
-                        fn->pn_dflags |= PND_FUNARG;
+                        fn->setFunArg();
                         queue->push(funbox);
                         break;
                     }
@@ -1737,7 +1738,7 @@ JSCompiler::markFunArgs(JSFunctionBox *funbox, uintN tcflags)
                      * which suppresses revisiting this function (namely the
                      * !lexdep->isFunArg() test just above).
                      */
-                    lexdep->pn_dflags |= PND_FUNARG;
+                    lexdep->setFunArg();
 
                     JSFunctionBox *afunbox = lexdep->pn_funbox;
                     queue.push(afunbox);

js/src/jsparse.h

@@ -462,6 +462,7 @@ struct JSParseNode {
     /* Defined below, see after struct JSDefinition. */
     bool isAssigned() const;
     bool isFunArg() const;
+    void setFunArg();
 
     void become(JSParseNode *pn2);
     void clear();
@@ -725,6 +726,17 @@ JSParseNode::isFunArg() const
     return test(PND_FUNARG);
 }
 
+inline void
+JSParseNode::setFunArg()
+{
+    if (pn_defn) {
+        ((JSDefinition *)this)->pn_dflags |= PND_FUNARG;
+    } else if (pn_used) {
+        pn_lexdef->pn_dflags |= PND_FUNARG;
+        pn_dflags |= PND_FUNARG;
+    }
+}
+
 struct JSObjectBox {
     JSObjectBox         *traceLink;
     JSObjectBox         *emitLink;