[ASDAlexander77]

Summary

An untyped catch (e) on Linux treated every exception whose type_info is a __pointer_type_info as a tslang class, and called the box thunk it loads from a fifth field (#351). Only tslang's _ZTIP<n><name> has that field.

A C++ throw "boom" (_ZTIPKc) from a linked native library read past the end of libstdc++'s type_info and called whatever it found there: a segfault inside the __pointer_type_info vtable, reproduced. The same applied to any pointer to a C++ class, and to a type_info emitted before the field existed.

• tslang's pointer type_info now sets a bit of its own in __flags (0x40000000). libstdc++ defines only the low qualifier bits. A throw and its catch emit their type_infos alike, so libstdc++'s qualifier check still sees equal flags.
• The catch reads the thunk field only when that bit is set. Any other pointer exception is boxed as an opaque value.

Verification

• New Linux-only test test-jit-foreign-throw-catch. A small C++ library (foreign-throw/foreign_throw.cpp, built by the tester's CMake) throws a const char*, a pointer to a C++ struct and an int into untyped catches. Beside them, a tslang class must still box as itself (instanceof). On main it segfaults.
• Linux (WSL): 2854/2854 passed.
• Windows Release: 2859/2859 passed (the code path is Itanium-only).

🤖 Generated with Claude Code