diff --git a/mozilla/js2/src/js2engine.cpp b/mozilla/js2/src/js2engine.cpp
index 4626111e4dd..da7449032c1 100644
--- a/mozilla/js2/src/js2engine.cpp
+++ b/mozilla/js2/src/js2engine.cpp
@@ -921,7 +921,8 @@ namespace MetaData {
         activationStackTop->env = meta->env;    // save current environment, to be restored on rts
         activationStackTop->newEnv = env;       // and save the new environment, if an exception occurs, we can't depend on meta->env
         activationStackTop->topFrame = env->getTopFrame();  // remember how big the new env. is supposed to be so that local frames don't accumulate
-        localFrame = checked_cast<NonWithFrame *>(activationStackTop->topFrame);
+        activationStackTop->localFrame = localFrame;
+//        localFrame = checked_cast<NonWithFrame *>(activationStackTop->topFrame);
         activationStackTop++;
         if (new_bCon) {
             bCon = new_bCon;
@@ -949,6 +950,7 @@ namespace MetaData {
         bCon = activationStackTop->bCon;
         pc = activationStackTop->pc;
         phase = activationStackTop->phase;
+        localFrame = activationStackTop->localFrame;
         // reset the env. top
         while (activationStackTop->newEnv->getTopFrame() != activationStackTop->topFrame)
             activationStackTop->newEnv->removeTopFrame();
diff --git a/mozilla/js2/src/js2engine.h b/mozilla/js2/src/js2engine.h
index 499c14fb289..c0dc460adfb 100644
--- a/mozilla/js2/src/js2engine.h
+++ b/mozilla/js2/src/js2engine.h
@@ -294,6 +294,7 @@ public:
         Environment *env;
         Environment *newEnv;
         Frame *topFrame;
+        NonWithFrame *localFrame;
     };
     void jsr(Phase execPhase, BytecodeContainer *bCon, uint32 stackBase, js2val returnVal, Environment *env);
     bool activationStackEmpty() { return (activationStackTop == activationStack); }
diff --git a/mozilla/js2/src/js2metadata.cpp b/mozilla/js2/src/js2metadata.cpp
index 7926f081125..7c6e5b30877 100644
--- a/mozilla/js2/src/js2metadata.cpp
+++ b/mozilla/js2/src/js2metadata.cpp
@@ -691,10 +691,10 @@ namespace MetaData {
         case StmtNode::group:
             {
                 BlockStmtNode *b = checked_cast<BlockStmtNode *>(p);
-                BlockFrame *runtimeFrame = new BlockFrame(b->compileFrame);
-                env->addFrame(runtimeFrame);    // XXX is this right? shouldn't this be the compile frame until execution occurs?
+//                BlockFrame *runtimeFrame = new BlockFrame(b->compileFrame);
+                env->addFrame(b->compileFrame);    // XXX is this right? shouldn't this be the compile frame until execution occurs?
                 bCon->emitOp(ePushFrame, p->pos);
-                bCon->addFrame(runtimeFrame);
+                bCon->addFrame(b->compileFrame);
                 StmtNode *bp = b->statements;
                 while (bp) {
                     SetupStmt(env, phase, bp);
@@ -2089,7 +2089,6 @@ doUnary:
                                     returnRef = new (*referenceArena) FrameSlotReference(checked_cast<FrameVariable *>(m)->frameSlot);
                                     break;
                                 }                                        
-                                break;
                                 keepLooking = false;
                             }
                         }
@@ -3107,6 +3106,7 @@ rescan:
             // need to reset the environment to the one in operation when eval was called so
             // that eval code can affect the apppropriate scopes.
             meta->engine->jsr(meta->engine->phase, NULL, meta->engine->sp - meta->engine->execStack, JS2VAL_VOID, meta->engine->activationStackTop[-1].env);
+//            meta->engine->localFrame = meta->engine->activationStackTop[-1].localFrame;
             js2val result = meta->readEvalString(*meta->toString(argv[0]), widenCString("Eval Source"));
             meta->engine->rts();
             return result;
diff --git a/mozilla/js2/src/js2metadata.h b/mozilla/js2/src/js2metadata.h
index b4b1f5fdb14..f3b4bd87113 100644
--- a/mozilla/js2/src/js2metadata.h
+++ b/mozilla/js2/src/js2metadata.h
@@ -1054,7 +1054,7 @@ public:
     virtual void emitReadBytecode(BytecodeContainer *bCon, size_t pos)      { bCon->emitOp(eSlotRead, pos); bCon->addShort((uint16)slotIndex); }
     virtual void emitWriteBytecode(BytecodeContainer *bCon, size_t pos)     { bCon->emitOp(eSlotWrite, pos); bCon->addShort((uint16)slotIndex); }
     virtual void emitReadForInvokeBytecode(BytecodeContainer *bCon, size_t pos)     { bCon->emitOp(eSlotRef, pos); bCon->addShort((uint16)slotIndex); }
-    virtual void emitReadForWriteBackBytecode(BytecodeContainer *bCon, size_t pos)  { emitReadForInvokeBytecode(bCon, pos); }
+    virtual void emitReadForWriteBackBytecode(BytecodeContainer *bCon, size_t pos)  { emitReadBytecode(bCon, pos); }
     virtual void emitWriteBackBytecode(BytecodeContainer *bCon, size_t pos)         { emitWriteBytecode(bCon, pos); }
 
     virtual void emitPostIncBytecode(BytecodeContainer *bCon, size_t pos)   { bCon->emitOp(eSlotPostInc, pos); bCon->addShort((uint16)slotIndex); }
@@ -1077,7 +1077,7 @@ public:
     virtual void emitReadBytecode(BytecodeContainer *bCon, size_t pos)      { bCon->emitOp(eFrameSlotRead, pos); bCon->addShort((uint16)slotIndex); }
     virtual void emitWriteBytecode(BytecodeContainer *bCon, size_t pos)     { bCon->emitOp(eFrameSlotWrite, pos); bCon->addShort((uint16)slotIndex); }
     virtual void emitReadForInvokeBytecode(BytecodeContainer *bCon, size_t pos)     { bCon->emitOp(eFrameSlotRef, pos); bCon->addShort((uint16)slotIndex); }
-    virtual void emitReadForWriteBackBytecode(BytecodeContainer *bCon, size_t pos)  { emitReadForInvokeBytecode(bCon, pos); }
+    virtual void emitReadForWriteBackBytecode(BytecodeContainer *bCon, size_t pos)  { emitReadBytecode(bCon, pos); }
     virtual void emitWriteBackBytecode(BytecodeContainer *bCon, size_t pos)         { emitWriteBytecode(bCon, pos); }
 
     virtual void emitPostIncBytecode(BytecodeContainer *bCon, size_t pos)   { bCon->emitOp(eFrameSlotPostInc, pos); bCon->addShort((uint16)slotIndex); }
@@ -1100,7 +1100,7 @@ public:
     virtual void emitReadBytecode(BytecodeContainer *bCon, size_t pos)      { bCon->emitOp(ePackageSlotRead, pos); bCon->addShort((uint16)slotIndex); }
     virtual void emitWriteBytecode(BytecodeContainer *bCon, size_t pos)     { bCon->emitOp(ePackageSlotWrite, pos); bCon->addShort((uint16)slotIndex); }
     virtual void emitReadForInvokeBytecode(BytecodeContainer *bCon, size_t pos)     { bCon->emitOp(ePackageSlotRef, pos); bCon->addShort((uint16)slotIndex); }
-    virtual void emitReadForWriteBackBytecode(BytecodeContainer *bCon, size_t pos)  { emitReadForInvokeBytecode(bCon, pos); }
+    virtual void emitReadForWriteBackBytecode(BytecodeContainer *bCon, size_t pos)  { emitReadBytecode(bCon, pos); }
     virtual void emitWriteBackBytecode(BytecodeContainer *bCon, size_t pos)         { emitWriteBytecode(bCon, pos); }
 
     virtual void emitPostIncBytecode(BytecodeContainer *bCon, size_t pos)   { bCon->emitOp(ePackageSlotPostInc, pos); bCon->addShort((uint16)slotIndex); }
diff --git a/mozilla/js2/src/js2op_access.cpp b/mozilla/js2/src/js2op_access.cpp
index ecaa06ef789..3f0a46a8234 100644
--- a/mozilla/js2/src/js2op_access.cpp
+++ b/mozilla/js2/src/js2op_access.cpp
@@ -261,6 +261,7 @@
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
+            ASSERT(slotIndex < localFrame->slots->size());
             a = top();
             (*localFrame->slots)[slotIndex] = a;
         }
@@ -270,6 +271,7 @@
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
+            ASSERT(slotIndex < localFrame->slots->size());
             // XXX some kind of code here?
         }
         break;
@@ -278,15 +280,27 @@
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
+            ASSERT(slotIndex < localFrame->slots->size());
             push((*localFrame->slots)[slotIndex]);
         }
         break;
-
+/*
+    case eFrameSlotRef:
+        {
+            uint16 slotIndex = BytecodeContainer::getShort(pc);
+            pc += sizeof(short);
+            push(JS2VAL_NULL);
+            ASSERT(slotIndex < localFrame->slots->size());
+            push((*localFrame->slots)[slotIndex]);
+        }
+        break;
+*/
     case ePackageSlotWrite:
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
             a = top();
+            ASSERT(slotIndex < packageFrame->slots->size());
             (*packageFrame->slots)[slotIndex] = a;
         }
         break;
@@ -295,6 +309,7 @@
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
+            ASSERT(slotIndex < packageFrame->slots->size());
             // XXX some kind of code here?
         }
         break;
@@ -303,6 +318,17 @@
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
+            ASSERT(slotIndex < packageFrame->slots->size());
+            push((*packageFrame->slots)[slotIndex]);
+        }
+        break;
+
+    case ePackageSlotRef:
+        {
+            uint16 slotIndex = BytecodeContainer::getShort(pc);
+            pc += sizeof(short);
+            push(JS2VAL_NULL);
+            ASSERT(slotIndex < packageFrame->slots->size());
             push((*packageFrame->slots)[slotIndex]);
         }
         break;
diff --git a/mozilla/js2/src/js2op_arithmetic.cpp b/mozilla/js2/src/js2op_arithmetic.cpp
index 84196ed7beb..50e330823fd 100644
--- a/mozilla/js2/src/js2op_arithmetic.cpp
+++ b/mozilla/js2/src/js2op_arithmetic.cpp
@@ -1154,6 +1154,7 @@
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
+            ASSERT(slotIndex < localFrame->slots->size());
             a = (*localFrame->slots)[slotIndex];
             float64 num = meta->toFloat64(a);
             (*localFrame->slots)[slotIndex] = allocNumber(num + 1.0);
@@ -1164,6 +1165,7 @@
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
+            ASSERT(slotIndex < localFrame->slots->size());
             a = (*localFrame->slots)[slotIndex];
             float64 num = meta->toFloat64(a);
             (*localFrame->slots)[slotIndex] = allocNumber(num - 1.0);
@@ -1174,6 +1176,7 @@
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
+            ASSERT(slotIndex < localFrame->slots->size());
             a = (*localFrame->slots)[slotIndex];
             float64 num = meta->toFloat64(a);
             a = pushNumber(num + 1.0);
@@ -1184,6 +1187,7 @@
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
+            ASSERT(slotIndex < localFrame->slots->size());
             a = (*localFrame->slots)[slotIndex];
             float64 num = meta->toFloat64(a);
             a = pushNumber(num - 1.0);
@@ -1195,6 +1199,7 @@
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
+            ASSERT(slotIndex < packageFrame->slots->size());
             a = (*packageFrame->slots)[slotIndex];
             float64 num = meta->toFloat64(a);
             (*packageFrame->slots)[slotIndex] = allocNumber(num + 1.0);
@@ -1205,6 +1210,7 @@
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
+            ASSERT(slotIndex < packageFrame->slots->size());
             a = (*packageFrame->slots)[slotIndex];
             float64 num = meta->toFloat64(a);
             (*packageFrame->slots)[slotIndex] = allocNumber(num - 1.0);
@@ -1215,6 +1221,7 @@
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
+            ASSERT(slotIndex < packageFrame->slots->size());
             a = (*packageFrame->slots)[slotIndex];
             float64 num = meta->toFloat64(a);
             a = pushNumber(num + 1.0);
@@ -1225,6 +1232,7 @@
         {
             uint16 slotIndex = BytecodeContainer::getShort(pc);
             pc += sizeof(short);
+            ASSERT(slotIndex < packageFrame->slots->size());
             a = (*packageFrame->slots)[slotIndex];
             float64 num = meta->toFloat64(a);
             a = pushNumber(num - 1.0);
diff --git a/mozilla/js2/src/js2op_invocation.cpp b/mozilla/js2/src/js2op_invocation.cpp
index 614414e3c45..49088fca46c 100644
--- a/mozilla/js2/src/js2op_invocation.cpp
+++ b/mozilla/js2/src/js2op_invocation.cpp
@@ -228,6 +228,8 @@
         {
             Frame *f = checked_cast<Frame *>(bCon->mObjectList[BytecodeContainer::getShort(pc)]);
             pc += sizeof(short);
+            if (meta->env->getTopFrame()->kind == ParameterKind)
+                localFrame = checked_cast<NonWithFrame *>(f);
             meta->env->addFrame(f);
             f->instantiate(meta->env);
         }