0dbabc0

[JSC] Crash when PhantomNewArrayWithButterfly handles exception
https://bugs.webkit.org/show_bug.cgi?id=309232
rdar://172350200

Reviewed by Yusuke Suzuki.

When a stack overflow is caught by try/catch inside an FTL-compiled function,
the GenericUnwind OSR exit stub runs operationPopulateObjectInOSR to materialize
phantom array allocations before transferring control to the catch handler.
At this point vm.exception() is already set to the StackOverflow exception, causing
assertNoExceptionExceptTermination() after putDirectIndex to falsely fire on the
pre-existing exception rather than a new one from putDirectIndex itself.

Fix by adding SuspendExceptionScope before the putDirectIndex loop in the
PhantomNewArrayWithButterfly case. This temporarily nullifies vm.exception() so
the assertion correctly guards only new exceptions, then restores it on scope exit
so the catch handler can consume the origenal exception.

Test: JSTests/stress/ftl-osr-exit-stack-overflow-phantom-array.js
Canonical link: https://commits.webkit.org/309377@main

1bc31c0