Created attachment 462013 [details]
Testcase

Tested on linux intel 64 and ARMv7.

Running the attached test case fails with the following message:

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737313221504) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=140737313221504) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=140737313221504, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff755e476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff75447f3 in __GI_abort () at ./stdlib/abort.c:79
#5  0x000055555562a8a7 in WTFCrashWithInfo () at /home/mgadelha/tools/WebKit/WebKitBuild/Debug/WTF/Headers/wtf/Assertions.h:754
#6  0x0000555556639b95 in JSC::LLInt::llint_slow_path_put_by_val_direct (callFrame=0x7fffffffd310, pc=0x55555939a17e) at /home/mgadelha/tools/WebKit/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1239
#7  0x00005555570f18e7 in llint_op_put_by_val_direct () at /home/mgadelha/tools/WebKit/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:118
#8  0x0000000000000000 in ?? ()

When disabling LLInt, we get:

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737313221504) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=140737313221504) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=140737313221504, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff755e476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff75447f3 in __GI_abort () at ./stdlib/abort.c:79
#5  0x000055555562a8a7 in WTFCrashWithInfo () at /home/mgadelha/tools/WebKit/WebKitBuild/Debug/WTF/Headers/wtf/Assertions.h:754
#6  0x000055555657ccf1 in JSC::directPutByValOptimize (globalObject=0x5555593132b8, codeBlock=0x5555593ac580, baseValue=..., subscript=..., value=..., stubInfo=0x5555593d3888, profile=0x5555593d3f98, 
    ecmaMode=...) at /home/mgadelha/tools/WebKit/Source/JavaScriptCore/jit/JITOperations.cpp:1168
#7  0x000055555657d3ab in JSC::operationDirectPutByValStrictOptimize (globalObject=0x5555593132b8, encodedBaseValue=10, encodedSubscript=-562949953421312, encodedValue=10, stubInfo=0x5555593d3888, 
    profile=0x5555593d3f98) at /home/mgadelha/tools/WebKit/Source/JavaScriptCore/jit/JITOperations.cpp:1218
...
#56 0x00005555570e2406 in vmEntryToJavaScript () at /home/mgadelha/tools/WebKit/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:367

Found by Igalia Fuzzing Campaign.