Guard an unsafe cast of a catch context's extension object.

src/objects.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 3210 matching lines @@
         if (ctxobj->map()->constructor() == arguments_function) {
           if (ctxobj->ReferencesObject(obj)) {
             return true;
           }
         } else if (ctxobj == obj) {
           return true;
         }
       }
     }
 
-    // Check the context extension if any.
-    if (context->has_extension()) {
+    // Check the context extension (if any) if it can have references.
+    if (context->has_extension() && !context->IsCatchContext()) {
       return JSObject::cast(context->extension())->ReferencesObject(obj);
     }
   }
 
   // No references to object.
   return false;
 }
 
 
 MaybeObject* JSObject::PreventExtensions() {
@@ skipping 7963 matching lines @@
   if (break_point_objects()->IsUndefined()) return 0;
   // Single beak point.
   if (!break_point_objects()->IsFixedArray()) return 1;
   // Multiple break points.
   return FixedArray::cast(break_point_objects())->length();
 }
 #endif
 
 
 } }  // namespace v8::internal