The patch fixes an OSR (on-stack replacement) stackmap layout mismatch between the IPInt (in-place interpreter) and the BBQ WebAssembly JIT for functions containing try blocks. BBQJIT::makeStackMap builds a StackMap describing where every live value lives (locals, exception/rethrow slots, enclosed expression stacks, and argument locations) so that operationWasmLoopOSREnterBBQJIT can copy those values into the correct registers/stack when transferring execution into BBQ-compiled code at a loop header. IPInt keeps exception values on a separate ‘shadow’ rethrow stack, and each try control frame carries a number of implicit slots. The old makeStackMap treated the try’s exception slot by simply doing ++numSlots and then, in the implicit-slot loop, emitting an OSREntryValue of type B3::Int64 for the exception (comment: ‘Exceptions are EncodedJSValues, so they are always Int64’). Because the try’s implicit exception slot could overlap the way IPInt lays out that shadow slot, the stackmap described a live Int64 exception where no real exception value exists at that program point, so on OSR the runtime would load/store a bogus value into an overlapping slot — the regression test is named ipint-bbq-osr-check-try-implicit-slot-overlap. The invariant violated is that every OSREntryValue in the stackmap must correspond to a value that genuinely exists and is safe to load at the OSR point.

The fix restructures the loop: for try frames it now emits the exception slot separately as an OSREntryValue with type B3::Void (‘We don’t actually have a real value here, so use Void to signify we shouldn’t load it’) and no longer inflates numSlots by one; then operationWasmLoopOSREnterBBQJIT’s writeValueToRep early-returns when the value type is B3::Void (‘Void signifies an unused exception slot in try’), so that slot is skipped instead of being written from an arbitrary buffer word. The remaining changes are whitespace-only (stackMapIndex ++ -> stackMapIndex++). Net effect: the try implicit exception slot is marked as a do-not-load placeholder, eliminating the overlapping/bogus write during OSR entry.

The commit establishes an OSR-entry state-reconstruction bug: for wasm functions with a try in a loop, BBQ’s stackmap described a nonexistent Int64 exception in an overlapping slot, and the runtime copied a bogus value into it, whose demonstrated effect is an unexpected crash in the WebContent process. Because the corruption is a wrong value written into a live OSR slot rather than an out-of-bounds buffer access, the realistic outcome is a crash or a corrupted register value; turning it into a controlled type confusion would require the overwritten slot to carry an attacker-typed value, which the diff does not demonstrate. It is confined to the wasm engine in the WebContent process and does not by itself escape the sandbox.