Bug 273931: pop With objects from scope chain as appropriate, when resetting

stack depth due to exception-handling flow control jumps. r=brendan.

js/src/jsinterp.c

@@ -1997,9 +1997,12 @@ js_Interpret(JSContext *cx, jsbytecode *pc, jsval *result)
 
           case JSOP_ENTERWITH:
             FETCH_OBJECT(cx, -1, rval, obj);
+            SAVE_SP(fp);
             withobj = js_NewObject(cx, &js_WithClass, obj, fp->scopeChain);
             if (!withobj)
                 goto out;
+            rval = INT_TO_JSVAL(sp - fp->spbase);
+            OBJ_SET_SLOT(cx, withobj, JSSLOT_PRIVATE, rval);
             fp->scopeChain = withobj;
             STORE_OPND(-1, OBJECT_TO_JSVAL(withobj));
             break;
@@ -4820,6 +4823,13 @@ js_Interpret(JSContext *cx, jsbytecode *pc, jsval *result)
             i = (jsint) GET_ATOM_INDEX(pc);
             JS_ASSERT(i >= 0);
             sp = fp->spbase + i;
+
+            obj = fp->scopeChain;
+            while (OBJ_GET_CLASS(cx, obj) == &js_WithClass &&
+                   JSVAL_TO_INT(OBJ_GET_SLOT(cx, obj, JSSLOT_PRIVATE)) > i) {
+                obj = OBJ_GET_PARENT(cx, obj);
+            }
+            fp->scopeChain = obj;
             break;
 
           case JSOP_GOSUB:

js/src/jsobj.c

@@ -1645,7 +1645,7 @@ with_getObjectOps(JSContext *cx, JSClass *clasp)
 
 JSClass js_WithClass = {
     "With",
-    0,
+    JSCLASS_HAS_PRIVATE,
     JS_PropertyStub,  JS_PropertyStub,  JS_PropertyStub,  JS_PropertyStub,
     JS_EnumerateStub, JS_ResolveStub,   JS_ConvertStub,   JS_FinalizeStub,
     with_getObjectOps,