242599 2022-07-11 12:26:59 -0700 [AArch32][Aarch64] ASSERTION FAILED variant.intrinsic() == NoIntrinsic in void JSC::DFG::ByteCodeParser::handleGetById 2022-07-12 14:43:20 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mikhail ysuzuki bfulgham webkit-bug-importer ysuzuki oldest_to_newest 1882089 0 460795 mikhail 2022-07-11 12:26:59 -0700 Created attachment 460795 Testcase Found by Igalia Fuzzing Campaign. The attached test case fails with the following message: ASSERTION FAILED: variant.intrinsic() == NoIntrinsic WebKit//Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp(4788) : void JSC::DFG::ByteCodeParser::handleGetById(JSC::VirtualRegister, JSC::SpeculatedType, JSC::DFG::Node*, JSC::CacheableIdentifier, unsigned int, JSC::GetByStatus, JSC::AccessType, JSC::BytecodeIndex) 1882090 1 webkit-bug-importer 2022-07-11 12:27:11 -0700 <rdar://problem/96836847> 1882501 2 ysuzuki 2022-07-12 13:30:22 -0700 This is stale assertion. Let's drop it. 1882503 3 ysuzuki 2022-07-12 13:32:04 -0700 Previously all intrinsic getters are handled. So at this point, it should be NoIntrinsic. But 4GB wasm array work added a case which can fail. But then, we should just continue using this generic path, invoking a getter. Thus, this assertion is stale. Let's just remove it. And marking it non-security since the solution is just removing this assertion and this is debug assertion. 1882525 4 ysuzuki 2022-07-12 13:49:23 -0700 Pull request: https://github.com/WebKit/WebKit/pull/2333 1882614 5 ews-feeder 2022-07-12 14:43:17 -0700 Committed 252391@main (1f3e8b70b999): <https://commits.webkit.org/252391@main> Reviewed commits have been landed. Closing PR #2333 and removing active labels. 460795 2022-07-11 12:26:59 -0700 2022-07-11 12:26:59 -0700 Testcase testcase.js text/javascript 134 mikhail dHJ5IHsKICBfX2ZfMih7fSkKfSBjYXRjaCB7Cn0KZnVuY3Rpb24gX19mXzIoX192XzIzKSB7IF9f dl8yMy5ieXRlT2Zmc2V0IH0KdHJ5IHsKICBmb3IgKDs7KQogICAgX19mXzIobmV3IEJpZ0ludDY0 QXJyYXkpCn0gY2F0Y2ggewp9Cgo=