test(regression): add test for ENG-21644 butterfly null pointer crash

This crash occurs when Array.prototype.splice calls valueOf on an object
whose valueOf method recursively modifies and deletes properties on itself.
The butterfly pointer becomes null during the recursive delete operations,
and subsequent property access causes a null pointer dereference.

This is a JSC bug - the fix needs to be in WebKit's JavaScriptCore code
at Butterfly.h:182 where member calls on potentially null butterflies
need to be guarded.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

test/regression/issue/ENG-21644.test.ts

@@ -0,0 +1,42 @@
+import { expect, test } from "bun:test";
+
+// ENG-21644: Butterfly null pointer dereference when Array.prototype.splice
+// calls valueOf on an object whose valueOf recursively modifies and deletes
+// properties, causing the butterfly to become null.
+// This is a JavaScriptCore bug in Butterfly.h:182.
+
+test("splice with valueOf that deletes properties should not crash", () => {
+  const Cls = class {
+    valueOf() {
+      this.h = this;
+      delete this.h;
+      this.valueOf();
+    }
+  };
+  const obj = new Cls();
+
+  // This should throw (stack overflow) but not crash/segfault
+  expect(() => {
+    [807983515].splice(obj);
+  }).toThrow();
+});
+
+test("minimal repro: splice with self-modifying valueOf", () => {
+  let count = 0;
+  const obj = {
+    valueOf() {
+      count++;
+      if (count < 100) {
+        this.prop = this;
+        delete this.prop;
+        return this.valueOf();
+      }
+      return 0;
+    },
+  };
+
+  // Should not crash
+  expect(() => {
+    [1, 2, 3].splice(obj);
+  }).not.toThrow();
+});