Fix off-by-one and logic bugs conspiring against catch blocks (339262, r=mrbkap).

js/src/jsemit.c

@@ -1516,8 +1516,11 @@ LexicalLookup(JSContext *cx, JSTreeContext *tc, JSAtom *atom, jsint *slotp)
     for (stmt = tc->topScopeStmt; stmt; stmt = stmt->downScope) {
         if (stmt->type == STMT_WITH)
             return stmt;
-        if (stmt->type == STMT_CATCH && stmt->label == atom)
-            return stmt;
+        if (stmt->type == STMT_CATCH) {
+            if (stmt->label == atom)
+                return stmt;
+            continue;
+        }
 
         JS_ASSERT(stmt->type == STMT_BLOCK_SCOPE);
         obj = stmt->blockObj;

js/src/jsemit.h

@@ -79,7 +79,7 @@ typedef enum JSStmtType {
 } JSStmtType;
 
 #define STMT_TYPE_IS_SCOPE(type) \
-    ((uintN)((type) - STMT_WITH) < (uintN)(STMT_CATCH - STMT_WITH))
+    ((uintN)((type) - STMT_WITH) <= (uintN)(STMT_CATCH - STMT_WITH))
 #define STMT_TYPE_IS_LOOP(type) ((type) >= STMT_DO_LOOP)
 
 #define STMT_IS_SCOPE(stmt)     STMT_TYPE_IS_SCOPE((stmt)->type)