Step 4 of the data-flow analysis fails to specify that the local variable array must be computed specially (akin to the operand stack) when the successor instruction is a handler. In particular, the local variable array to be merged into the successor instruction is NOT the local variable array computed in step 2, but rather the local variable array immediately PRIOR to step 2. (The type-checking verifier models this correctly via the oft-seen clause exceptionStackFrame(StackFrame, ExceptionStackFrame).)

(As a separate matter of presentation, the paragraph "In the special case of control transfer to an exception handler ..." should appear after the common-case bullets about visiting the successor instruction.)