Don't try to bind label names to slots (349619, r=shaver).

js/src/jsemit.c

@@ -2195,7 +2195,12 @@ CheckSideEffects(JSContext *cx, JSTreeContext *tc, JSParseNode *pn,
         break;
 
       case PN_NAME:
-        if (pn->pn_type == TOK_NAME) {
+        /*
+         * Take care to avoid trying to bind a label name (labels, both for
+         * statements and property values in object initialisers, have pn_op
+         * defaulted to JSOP_NOP).
+         */
+        if (pn->pn_type == TOK_NAME && pn->pn_op != JSOP_NOP) {
             if (!BindNameToSlot(cx, tc, pn))
                 return JS_FALSE;
             if (pn->pn_slot < 0 && pn->pn_op != JSOP_ARGUMENTS) {

js/src/jsparse.c

@@ -5323,6 +5323,8 @@ PrimaryExpr(JSContext *cx, JSTokenStream *ts, JSTreeContext *tc,
                                 return NULL;
                             pn3->pn_atom = CURRENT_TOKEN(ts).t_atom;
                             pn3->pn_expr = NULL;
+                            pn3->pn_slot = -1;
+                            pn3->pn_attrs = 0;
 
                             /* We have to fake a 'function' token here. */
                             CURRENT_TOKEN(ts).t_op = JSOP_NOP;