Push catch and with statements onto tc->topScopeStmt so we don't optimize variable lookups inside of them. Also, protect against adding a stmt to the scope statement list twice. bug 345867, r=brendan

js/src/jsemit.c

@@ -1229,8 +1229,13 @@ js_PushStatement(JSTreeContext *tc, JSStmtInfo *stmt, JSStmtType type,
     stmt->label = NULL;
     stmt->down = tc->topStmt;
     tc->topStmt = stmt;
-    stmt->downScope = NULL;
     stmt->blockObj = NULL;
+    if (STMT_IS_SCOPE(stmt)) {
+        stmt->downScope = tc->topScopeStmt;
+        tc->topScopeStmt = stmt;
+    } else {
+        stmt->downScope = NULL;
+    }
 }
 
 void

js/src/jsparse.c

@@ -2953,10 +2953,14 @@ Statement(JSContext *cx, JSTokenStream *ts, JSTreeContext *tc)
             obj = js_NewBlockObject(cx);
             if (!obj)
                 return NULL;
-            JS_ASSERT(stmt->downScope == NULL);
+            JS_ASSERT(!(stmt->flags & SIF_SCOPE));
             stmt->flags |= SIF_SCOPE;
-            stmt->downScope = tc->topScopeStmt;
-            tc->topScopeStmt = stmt;
+            if (!stmt->downScope) {
+                stmt->downScope = tc->topScopeStmt;
+                tc->topScopeStmt = stmt;
+            } else {
+                JS_ASSERT(stmt == tc->topScopeStmt);
+            }
             obj->slots[JSSLOT_PARENT] = OBJECT_TO_JSVAL(tc->blockChain);
             tc->blockChain = stmt->blockObj = obj;