Espruino on your watch!

I guess it'd make sense to stop the watchdog inside jshReset (or ensure that 'auto' watchdog stayed working) to avoid this sort of problem?

I guess you can't disable watchdog without doing reboot which is the point of having reset() call (so it works e.g. over BLE connection without disconnecting). So if upload could find that manual watchdog mode is enabled, then switch to automatic mode (if possible) or just refuse upload. Or at leasrt disable 'reset before upload', or .... it is complicated due to different upload modes (to ram vs to storage). I guess upload to storage does not need reset before upload checkbox enabled. It just writes .bootcde and then could reset after upload an load it. Reset before upload makes more sense with upload to RAM since it is full and stuff is otherwise modified in place (?).
BTW, I find all those settings for code upload scattered over all other IDE setings hard to manage as I want to change them often. Would prefer the 'send to espruino' button pop up small dialog (maybe only when holding the button longer?) with just few options : reset before upload,save on send mode, set time and maybe minify yes/no. Sometime I would even only check 'set time' without any code upload.

Come to think of it, should auto watchdog cause Espruino to automatically wake up in time to kick the watchdog? It'd seem sensible.

Well, yes but the empty setInterval workaround solves it too, depend how much work and code it is.

I wouldn't have thought Espruino would get 'stuck' executing code since it should break out with an exception when it hits the first 0xff

Yes sounds strange. I don't know what is was, just that both serial and NUS console was not available after that watchdog reboot. The device was still advertising but web ide could no connect. So after trying it for few minutes I left it alone and tried later.

but you may have been unlucky in that the part of the code that was saved may have enabled watchdog, but then the bit that actually kicked it didn't get loaded?

It was like this:
I uploaded code with first two lines added like this

E.enableWatchdog(6, false);
var wdint=setInterval(function(){if(!BTN1.read())E.kickWatchdog();},1000);

and then my other code. This worked fine and after testing it and doing some changes in IDE I wanted upload another version with changes. And unfortunately I had 'Reset before Send' setting enabled. So it called reset() and then started upload which was longer that 6 seconds.

And so my guess is that it rebooted with inconsistent storage with half of code and rest of 0xff and additionally after reboot and running through this, the serial console was further flooded with the rest of uploaded code.