ie8 and mangle can result in incorrect Javascript code in the presence of try...except blocks

[jfly]

Bug report

Uglify version (uglifyjs -V)
3.4.5

JavaScript input

function foo() {
    var createEvent = function createEvent(name) {
        return "hiya";
    };
    try {
        new Event('test');
    } catch (e) {
        createEvent = function createEvent(name) {
            return "biya";
        };
    }
    console.log(createEvent);
}

The uglifyjs CLI command executed or minify() options used.
--ie8 --mangle

JavaScript output.

$ npx uglify-js@3.4.5 ./autosize.js --ie8 --mangle | npx prettier --stdin-filepath autosize.js
npx: installed 3 in 0.796s
npx: installed 1 in 0.853s
function foo() {
  var n = function n(n) {
    return "hiya";
  };
  try {
    new Event("test");
  } catch (t) {
    createEvent = function createEvent(n) {
      return "biya";
    };
  }
  console.log(n);
}

Note how the produced javascript code sets a createEvent variable in the catch above, despite the fact that createEvent was renamed to n in the other two places where the original Javascript referred to it. This is incorrect behavior. I would expect the two occurrences of createEvent in the catch to also be changed to n.

The above code may look kind of weird, but it's a simplified version of this real life code from autosize: https://github.com/jackmoore/autosize/blob/6ae70cd3d28888eb858eef1167e6ed75d25dff7f/dist/autosize.js#L48-L60. See thewca/worldcubeassociation.org#3047 for more information about how we ran into this issue.

[alexlamsl]

@jfly thanks for the detailed report - fix is on the way.

[jfly]

Whooo! Thanks for the quick response!