It seems like the esp value (which is saved at [ebp-16]) is sometimes
changed inside the catch handler so we end up with a bogus esp
afterwards.  To avoid that save it before calling the catch block.