--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -1797,25 +1797,32 @@ BindDestructuringArg(JSContext *cx, Bind
     JS_ASSERT(tc->inFunction());
 
     if (tc->decls.lookup(atom)) {
         ReportCompileErrorNumber(cx, TS(tc->parser), NULL, JSREPORT_ERROR,
                                  JSMSG_DESTRUCT_DUP_ARG);
         return JS_FALSE;
     }
 
+    JSParseNode *pn = data->pn;
+
     /*
      * Distinguish destructured-to binding nodes as vars, not args, by setting
      * pn_op to JSOP_SETLOCAL. Parser::functionDef checks for this pn_op value
      * when processing the destructuring-assignment AST prelude induced by such
      * destructuring args in Parser::functionArguments.
+     *
+     * We must set the PND_BOUND flag too to prevent pn_op from being reset to
+     * JSOP_SETNAME by BindDestructuringVar. The only field not initialized is
+     * pn_cookie; it gets set in functionDef in the first "if (prelude)" block.
      */
-    data->pn->pn_op = JSOP_SETLOCAL;
-
-    return Define(data->pn, atom, tc);
+    pn->pn_op = JSOP_SETLOCAL;
+    pn->pn_dflags |= PND_BOUND;
+
+    return Define(pn, atom, tc);
 }
 #endif /* JS_HAS_DESTRUCTURING */
 
 JSFunction *
 Parser::newFunction(JSTreeContext *tc, JSAtom *atom, uintN lambda)
 {
     JSObject *parent;
     JSFunction *fun;
@@ -3007,17 +3014,16 @@ Parser::functionDef(JSAtom *funAtom, Fun
             /* Filter based on pn_op -- see BindDestructuringArg, above. */
             if (apn->pn_op != JSOP_SETLOCAL)
                 continue;
 
             uintN index = fun->u.i.nvars;
             if (!BindLocalVariable(context, fun, apn->pn_atom, JSLOCAL_VAR, true))
                 return NULL;
             apn->pn_cookie.set(funtc.staticLevel, index);
-            apn->pn_dflags |= PND_BOUND;
         }
     }
 #endif
 
     if (type == GETTER && fun->nargs > 0) {
         reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_ACCESSOR_WRONG_ARGS,
                           "getter", "no", "s");
         return NULL;