Bug 253489

for (let v0 = 0; v0 < 10; v0++) {
  try {
    const v1 = [129, 127];
    const v3 = Symbol.iterator;
    v1[v3] = Symbol;
    [] = v1;
    print(1)
  } catch (e10) {
   
  }
}

With the above script as input to JSC, run JSC with the following parameters:
./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=0

The correct result should print nothing, but JSC print "1" in baselineJIT. The problem may be in op_iterator_open in baselineJIT. In LLInt, JSC will judge whether iterator is JSCell or JSObject. However, in baseline, JSC only judge whether iterator is JSCell, JSObect is ignored. In this way, no exception will be thrown in baselineJIT.