Bug 1282502 - Report an error if there are too many block scoped bindings r=shu a=abillings

js/src/frontend/Parser.cpp

@@ -558,6 +558,9 @@ ParseContext<ParseHandler>::generateBindings(ExclusiveContext* cx, TokenStream&
     if (UINT32_MAX - args_.length() <= vars_.length() + bodyLevelLexicals_.length())
         return ts.reportError(JSMSG_TOO_MANY_LOCALS);
 
+    if (blockScopeDepth >= Bindings::BLOCK_SCOPED_LIMIT)
+        return ts.reportError(JSMSG_TOO_MANY_LOCALS);
+
     // Fix up slots in non-global contexts. In global contexts all body-level
     // names are dynamically defined and do not live in either frame or
     // CallObject slots.

js/src/jsscript.h

@@ -256,6 +256,7 @@ class Bindings
 
   public:
     static const uint32_t BODY_LEVEL_LEXICAL_LIMIT = UINT16_LIMIT;
+    static const uint32_t BLOCK_SCOPED_LIMIT = UINT16_LIMIT;
 
     Binding* bindingArray() const {
         return reinterpret_cast<Binding*>(bindingArrayAndFlag_ & ~TEMPORARY_STORAGE_BIT);