Bug 259507

running git log shows commit a5fec4a8500ecf6353ba31991c4b81e2029a6afc (HEAD, origin/main, origin/HEAD, main)
Author: Charlie Wolfe <charliew@apple.com>
Date:   Thu Jul 6 16:57:52 2023 -0700

    Fix internal Apple builds after 265828@main
    https://bugs.webkit.org/show_bug.cgi?id=258952
    rdar://111877556
    
    Unreviewed build fix.
    
    UUID -> WTF::UUID


Both Debug with assertion failure 
Seems to only crash with Debug build with --useConcurrentJIT=false flag banned as follows:

./jsc --validateOptions=true --useConcurrentGC=true --useConcurrentJIT=false --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --validateBCE=false /Users/bootywarrior/Desktop/oob.js

[COV] no shared memory bitmap available, skipping
[COV] edge counters initialized. Shared memory: (null) with 1067055 edges
ASSERTION FAILED: m_graph.canOptimizeStringObjectAccess(node->origin.semantic)
/Users/bootywarrior/Desktop/WebKit/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp(3757) : auto JSC::DFG::FixupPhase::attemptToMakeFastStringAdd(JSC::DFG::Node *)::(anonymous class)::operator()(JSC::DFG::Edge &) const
1   0x106eabac8 WTFCrash
2   0x1061a1390 WTFCrashWithInfo(int, char const*, char const*, int)
3   0x1054d51c4 JSC::DFG::FixupPhase::attemptToMakeFastStringAdd(JSC::DFG::Node*)::'lambda0'(JSC::DFG::Edge&)::operator()(JSC::DFG::Edge&) const
4   0x1054c20ac JSC::DFG::FixupPhase::attemptToMakeFastStringAdd(JSC::DFG::Node*)
5   0x1054b5660 JSC::DFG::FixupPhase::fixupNode(JSC::DFG::Node*)
6   0x1054b2d3c JSC::DFG::FixupPhase::run()
7   0x10546de90 bool JSC::DFG::runPhase<JSC::DFG::FixupPhase>(JSC::DFG::Graph&)
8   0x1055ed4e4 JSC::DFG::Plan::compileInThreadImpl()
9   0x105f36330 JSC::JITPlan::compileInThread(JSC::JITWorklistThread*)
10  0x105f8acc4 JSC::JITWorklist::enqueue(WTF::Ref<JSC::JITPlan, WTF::RawPtrTraits<JSC::JITPlan>>)
11  0x10546c4c4 JSC::DFG::compile(JSC::VM&, JSC::CodeBlock*, JSC::CodeBlock*, JSC::JITCompilationMode, JSC::BytecodeIndex, JSC::Operands<std::__1::optional<JSC::JSValue>, WTF::Vector<std::__1::optional<JSC::JSValue>, 0ul, WTF::UnsafeVectorOverflow, 16ul, WTF::FastMalloc>> const&, WTF::Ref<JSC::DeferredCompilationCallback, WTF::RawPtrTraits<JSC::DeferredCompilationCallback>>&&)
12  0x105ef17f4 operationOptimize
13  0x130840d14 (null)
14  0x104ad2b80 vmEntryToJavaScript
15  0x105df8da8 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*)
16  0x10623d7b4 JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
17  0x104a80dfc int runJSC<jscmain(int, char**)::$_7>(CommandLine const&, bool, jscmain(int, char**)::$_7 const&)
18  0x104a7d2e8 jscmain(int, char**)
19  0x104a7cd7c main
20  0x195897f28 start
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==50397==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x0000bbadbeef (pc 0x000106eabad0 bp 0x00016b38bff0 sp 0x00016b38bff0 T6938220)
==50397==The signal is caused by a WRITE memory access.
    #0 0x106eabad0 in WTFCrash Assertions.cpp:327
    #1 0x1061a138c in WTFCrashWithInfo(int, char const*, char const*, int) Assertions.h:762
    #2 0x1054d51c0 in JSC::DFG::FixupPhase::attemptToMakeFastStringAdd(JSC::DFG::Node*)::'lambda0'(JSC::DFG::Edge&)::operator()(JSC::DFG::Edge&) const DFGFixupPhase.cpp:3757
    #3 0x1054c20a8 in JSC::DFG::FixupPhase::attemptToMakeFastStringAdd(JSC::DFG::Node*) DFGFixupPhase.cpp:3745
    #4 0x1054b565c in JSC::DFG::FixupPhase::fixupNode(JSC::DFG::Node*) DFGFixupPhase.cpp:550
    #5 0x1054b2d38 in JSC::DFG::FixupPhase::run() DFGFixupPhase.cpp:57
    #6 0x10546de8c in bool JSC::DFG::runPhase<JSC::DFG::FixupPhase>(JSC::DFG::Graph&) DFGPhase.h:95
    #7 0x1055ed4e0 in JSC::DFG::Plan::compileInThreadImpl() DFGPlan.cpp:259
    #8 0x105f3632c in JSC::JITPlan::compileInThread(JSC::JITWorklistThread*) JITPlan.cpp:172
    #9 0x105f8acc0 in JSC::JITWorklist::enqueue(WTF::Ref<JSC::JITPlan, WTF::RawPtrTraits<JSC::JITPlan>>) JITWorklist.cpp:84
    #10 0x10546c4c0 in JSC::DFG::compile(JSC::VM&, JSC::CodeBlock*, JSC::CodeBlock*, JSC::JITCompilationMode, JSC::BytecodeIndex, JSC::Operands<std::__1::optional<JSC::JSValue>, WTF::Vector<std::__1::optional<JSC::JSValue>, 0ul, WTF::UnsafeVectorOverflow, 16ul, WTF::FastMalloc>> const&, WTF::Ref<JSC::DeferredCompilationCallback, WTF::RawPtrTraits<JSC::DeferredCompilationCallback>>&&) DFGDriver.cpp:106
    #11 0x105ef17f0 in operationOptimize JITOperations.cpp:2309
    #12 0x130840d10  (<unknown module>)
    #13 0x104ad2b7c in vmEntryToJavaScript+0x100 (jsc:arm64+0x100062b7c) (BuildId: 2be14f68bcb33bc1be765002813ed97232000000200000000100000000000d00)
    #14 0x105df8da4 in JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) Interpreter.cpp:1025
    #15 0x10623d7b0 in JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) Completion.cpp:137
    #16 0x104a80df8 in int runJSC<jscmain(int, char**)::$_7>(CommandLine const&, bool, jscmain(int, char**)::$_7 const&) jsc.cpp:4087
    #17 0x104a7d2e4 in jscmain(int, char**) jsc.cpp:4286
    #18 0x104a7cd78 in main jsc.cpp:3426
    #19 0x195897f24  (<unknown module>)

==50397==Register values:
 x[0] = 0x000000016b38be90   x[1] = 0x0000000000000000   x[2] = 0x00000000000120a8   x[3] = 0x000000016b38b87e  
 x[4] = 0x0000000195b00a6f   x[5] = 0x000000016b38bdd0   x[6] = 0x000000000000000a   x[7] = 0x0000000000000000  
 x[8] = 0x00000000bbadbeef   x[9] = 0x7e6fc1bbda4400a0  x[10] = 0x0000000000000001  x[11] = 0x00000000fffffffd  
x[12] = 0x0000010000000000  x[13] = 0x0000000000000000  x[14] = 0x0000000000000000  x[15] = 0x0000000000000000  
x[16] = 0x0000000195bb08ec  x[17] = 0x00000001f5b78e18  x[18] = 0x0000000000000000  x[19] = 0x00000001075cae0b  
x[20] = 0x00000001075cb3e2  x[21] = 0x000000016b38c078  x[22] = 0x0000000112042480  x[23] = 0x0000000107fb4000  
x[24] = 0x000000000000005b  x[25] = 0x000000016b38c390  x[26] = 0x0000000000000000  x[27] = 0x0000000112042600  
x[28] = 0x000000016b38c390     fp = 0x000000016b38bff0     lr = 0x0000000106eabac8     sp = 0x000000016b38bff0  
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV Assertions.cpp:327 in WTFCrash
==50397==ABORTING

minimal POC : 

for(var i = 0; i < 1000; i++) {
    (-2 + "-2147483647")+{};
}


Original POC :

for (let [i14, i15] = (() => {
        function F2(a4) {
            if (!new.target) { throw 'must be called with new'; }
        }
        const v5 = new F2(10);
        const v10 = JSON.stringify(2).substring();
        ("O" + v5) + v10;
        for (let v13 = 0; v13 < 1000000; v13++) {
        }
        return [-4294967297, 10];
    })();
    i15;
    i15--) {
}
// CRASH INFO
// ==========
// INSTANCE TAG: 
// TERMSIG: 11
// STDERR:
// ASSERTION FAILED: m_graph.canOptimizeStringObjectAccess(node->origin.semantic)
// /Users/bootywarrior/Desktop/WebKit/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp(3757) : auto JSC::DFG::FixupPhase::attemptToMakeFastStringAdd(JSC::DFG::Node *)::(anonymous class)::operator()(JSC::DFG::Edge &) const
// 1   0x106d67ac8 WTFCrash
// 2   0x10605d390 WTFCrashWithInfo(int, char const*, char const*, int)
// 3   0x1053911c4 JSC::DFG::FixupPhase::attemptToMakeFastStringAdd(JSC::DFG::Node*)::'lambda0'(JSC::DFG::Edge&)::operator()(JSC::DFG::Edge&) const
// 4   0x105390e64 void JSC::DFG::Graph::doToChildrenWithNode<void JSC::DFG::Graph::doToChildren<JSC::DFG::FixupPhase::attemptToMakeFastStringAdd(JSC::DFG::Node*)::'lambda0'(JSC::DFG::Edge&)>(JSC::DFG::Node*, JSC::DFG::FixupPhase::attemptToMakeFastStringAdd(JSC::DFG::Node*)::'lambda0'(JSC::DFG::Edge&) const&)::ForwardingFunc>(JSC::DFG::Node*, JSC::DFG::FixupPhase::attemptToMakeFastStringAdd(JSC::DFG::Node*)::'lambda0'(JSC::DFG::Edge&) const&)
// 5   0x10537e0ac JSC::DFG::FixupPhase::attemptToMakeFastStringAdd(JSC::DFG::Node*)
// 6   0x105371660 JSC::DFG::FixupPhase::fixupNode(JSC::DFG::Node*)
// 7   0x10536ed3c JSC::DFG::FixupPhase::run()
// 8   0x105329e90 bool JSC::DFG::runPhase<JSC::DFG::FixupPhase>(JSC::DFG::Graph&)
// 9   0x1054a94e4 JSC::DFG::Plan::compileInThreadImpl()
// 10  0x105df2330 JSC::JITPlan::compileInThread(JSC::JITWorklistThread*)
// 11  0x105e46cc4 JSC::JITWorklist::enqueue(WTF::Ref<JSC::JITPlan, WTF::RawPtrTraits<JSC::JITPlan>>)
// 12  0x1053284c4 JSC::DFG::compile(JSC::VM&, JSC::CodeBlock*, JSC::CodeBlock*, JSC::JITCompilationMode, JSC::BytecodeIndex, JSC::Operands<std::__1::optional<JSC::JSValue>, WTF::Vector<std::__1::optional<JSC::JSValue>, 0ul, WTF::UnsafeVectorOverflow, 16ul, WTF::FastMalloc>> const&, WTF::Ref<JSC::DeferredCompilationCallback, WTF::RawPtrTraits<JSC::DeferredCompilationCallback>>&&)
// 13  0x105dad7f4 operationOptimize
// 14  0x12c0507d8 (null)
// 15  0x1049b4d2c llint_entry
// 16  0x10498eb80 vmEntryToJavaScript
// 17  0x105cb4da8 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*)
// 18  0x1060f97b4 JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
// 19  0x10493cdfc int runJSC<jscmain(int, char**)::$_7>(CommandLine const&, bool, jscmain(int, char**)::$_7 const&)
// 20  0x1049392e8 jscmain(int, char**)
// 21  0x104938d7c main
// 22  0x195897f28 start
// STDOUT: