--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -3142,16 +3142,17 @@ JSFunction::addLocal(JSContext *cx, JSAt
                              (kind == JSLOCAL_ARG)
                              ? JSMSG_TOO_MANY_FUN_ARGS
                              : JSMSG_TOO_MANY_LOCALS);
         return false;
     }
 
     jsid id;
     if (!atom) {
+        /* Destructuring formal parameter: use argument index as id. */
         JS_ASSERT(kind == JSLOCAL_ARG);
         id = INT_TO_JSID(nargs);
     } else {
         id = ATOM_TO_JSID(atom);
     }
 
     Shape child(id, getter, setter, slot, attrs, Shape::HAS_SHORTID, *indexp);
 

--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -1808,16 +1808,25 @@ BindDestructuringArg(JSContext *cx, Bind
      * Distinguish destructured-to binding nodes as vars, not args, by setting
      * pn_op to JSOP_SETLOCAL. Parser::functionDef checks for this pn_op value
      * when processing the destructuring-assignment AST prelude induced by such
      * destructuring args in Parser::functionArguments.
      *
      * We must set the PND_BOUND flag too to prevent pn_op from being reset to
      * JSOP_SETNAME by BindDestructuringVar. The only field not initialized is
      * pn_cookie; it gets set in functionDef in the first "if (prelude)" block.
+     * We have to wait to set the cookie until we can call JSFunction::addLocal
+     * with kind = JSLOCAL_VAR, after all JSLOCAL_ARG locals have been added.
+     *
+     * Thus a destructuring formal parameter binds an ARG (as in arguments[i]
+     * element) with a null atom name for the object or array passed in to be
+     * destructured, and zero or more VARs (as in named local variables) for
+     * the destructured-to identifiers in the property value positions within
+     * the object or array destructuring pattern, and all ARGs for the formal
+     * parameter list bound as locals before any VAR for a destructured name.
      */
     pn->pn_op = JSOP_SETLOCAL;
     pn->pn_dflags |= PND_BOUND;
 
     return Define(pn, atom, tc);
 }
 #endif /* JS_HAS_DESTRUCTURING */
 

--- a/js/src/tests/js1_8_5/regress/jstests.list
+++ b/js/src/tests/js1_8_5/regress/jstests.list
@@ -55,11 +55,12 @@ fails-if(!xulRuntime.shell) script regre
 fails-if(!xulRuntime.shell) script regress-607863.js
 script regress-610026.js
 script regress-609617.js
 script regress-617405-1.js
 script regress-617405-2.js
 script regress-618572.js
 skip-if(!xulRuntime.shell) script regress-618576.js  # uses evalcx
 fails-if(!xulRuntime.shell) script regress-618652.js
-script regress-619003.js
+script regress-619003-1.js
+script regress-619003-2.js
 script regress-620376-1.js
 script regress-620376-2.js

rename from js/src/tests/js1_8_5/regress/regress-619003.js
rename to js/src/tests/js1_8_5/regress/regress-619003-1.js

new file mode 100644
--- /dev/null
+++ b/js/src/tests/js1_8_5/regress/regress-619003-2.js
@@ -0,0 +1,9 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+var expect = "global";
+var actual = expect;
+function f([actual]) { }
+f(["local"]);
+reportCompare(expect, actual, "ok");