Created attachment 462214 [details]
Crash reproduction file

It's possible to trigger a segfault while running the attached JS file (minimized from a much larger example contained in the Wasm GC tests, thanks to Mikhail Gadelha) on ARMv7 JSC:

```
# example of how to run the crashing test
$ ~/WebKit/WebKitBuild/Debug/bin/jsc --thresholdForJITAfterWarmUp=45 --thresholdForOptimizeAfterWarmUp=21 -m crash.js
Segmentation fault
```

This bug appears to be triggered by a storeCell instruction used in the DFG OSR exit code for reifying inlined call frames. The store itself is reasonable, but the macroassembler on ARMv7 seems to create a register conflict when the memory address for the store takes a particular form, as it triggers a less used codepath in the macroassembler.