This fixes a B3 miscompilation where strength reduction’s Select specialization cloned values that must not be cloned — specifically call patchpoints inside a try/catch that carry an exception-restoration stackmap. In B3ReduceStrength, when a Select feeds a Check, specializeSelect splits the path and CLONES the values between the Select and the Check to specialize each arm.

Pre-patch, it did this whenever a suitable Select was found, without verifying the intervening values are cloneable. Separately, WASM call patchpoints generated inside a try (OMGIRGenerator::createCallPatchpoint with m_tryCatchDepth) carry a catch-restoration stackmap keyed by CallSiteIndex (used by preparePatchpointForExceptions to restore state when an exception unwinds to the catch). Cloning such a patchpoint would create two call sites aliasing ONE stackmap/CallSiteIndex, so on exception the wrong state is restored — a type-confusion/memory-corruption condition.

The fix marks those in-try call patchpoints as cloningForbidden (auto patchpointKind = m_tryCatchDepth ? cloningForbidden(Patchpoint) : Patchpoint, with an ASSERT in preparePatchpointForExceptions that the patch kind is cloningForbidden), and makes specializeSelect check that ALL values between the Select and the Check are cloneable (kind().isCloningForbidden()) before specializing — bailing if any forbids cloning.

The restored invariant is that B3 never clones a value whose identity is semantically required (like an exception-stackmap-bearing call), so exception restoration cannot be aliased across call sites.