Bug 309232 – [JSC] Crash when PhantomNewArrayWithButterfly handles exception

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[GuY]

run args:
WebKitBuild/JSCOnly/Debug/bin/jsc test.js --useConcurrentJIT=0

```
function opt() {
    const arr = Array(10);
    arr[0] = 0;
    function foo() { return arr; }
    try {
        opt()
        opt()
    } catch (e) {
    }
}
for(let i=0;i<10000000;i++){
    opt()
}
```

[Radar WebKit Bug Importer]

<rdar://problem/172350200>

[Yijia Huang]

Pull request: https://github.com/WebKit/WebKit/pull/60714

[EWS]

Committed 309377@main (0dbabc018f3f): <https://commits.webkit.org/309377@main>

Reviewed commits have been landed. Closing PR #60714 and removing active labels.