Although I don't know how they do it in, there is a simple way to do it.
Everything in JS has toString() method. For functions, it shows the source code of that particular function (for in-built functions, you may get something like function() { [native code] }).
Let us find the first ( and the first ), which enclose the function's arguments. Then, let's strip the whitespaces and split the arguments by ,. Voila, we get an array of argument names.
function a($scope, $http) { };
function b($http, $scope) { };
function getParameterList(f) {
var s = f.toString();
var start = s.indexOf('(');
var end = s.indexOf(')');
s = s.substring(start + 1, end);
return s.replace(/ /g,'').split(',');
}
So let's test it:
var aParams = getParameterList(a);
var bParams = getParameterList(b);
alert(aParams[0]); // $scope
alert(aParams[1]); // $http
alert(bParams[0]); // $http
alert(bParams[1]); // $scope
A fiddle: http://jsfiddle.net/jYPB8/
However, note that this behaviour of toString() is defined in Function.prototype and may be redefined - in which case, this algorithm won't work.
So while this may not be the actual solution you were looking for, I wanted to show you that this kind of reflection is possible in JavaScript, and it's actually very simple to do :)