Oops, tree wasn't open -- Chase needs to pull again, so backing out temporarily.

js/src/jsemit.c

@@ -2892,7 +2892,6 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         if (cg->treeContext.flags & TCF_IN_FUNCTION) {
             JSObject *obj, *pobj;
             JSProperty *prop;
-            JSScopeProperty *sprop;
             uintN slot;
 
             obj = OBJ_GET_PARENT(cx, fun->object);
@@ -2900,11 +2899,8 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                                          &pobj, &prop)) {
                 return JS_FALSE;
             }
-
             JS_ASSERT(prop && pobj == obj);
-            sprop = (JSScopeProperty *) prop;
-            JS_ASSERT(sprop->getter == js_GetLocalVariable);
-            slot = sprop->shortid;
+            slot = ((JSScopeProperty *) prop)->shortid;
             OBJ_DROP_PROPERTY(cx, pobj, prop);
 
             if (atomIndex >= JS_BIT(16)) {

js/src/jsparse.c

@@ -830,9 +830,7 @@ FunctionDef(JSContext *cx, JSTokenStream *ts, JSTreeContext *tc,
             }
             if (prop)
                 OBJ_DROP_PROPERTY(cx, pobj, prop);
-            if (!prop ||
-                pobj != varobj ||
-                ((JSScopeProperty *)prop)->getter != js_GetLocalVariable) {
+            if (!prop || pobj != varobj) {
                 if (!js_AddHiddenProperty(cx, varobj, ATOM_TO_JSID(funAtom),
                                           js_GetLocalVariable,
                                           js_SetLocalVariable,