Bug 299846 – JIT Optimization bug: DFG ASSERTION FAILED: Bad data format

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

JavascriptCore version
```
commit: 57a0f2
```

Build commands:
```
Tools/Scripts/build-jsc --jsc-only --debug --cmakeargs="-DENABLE_STATIC_JSC=ON -DCMAKE_CXX_FLAGS='-Wno-error -Wno-all -Wno-extra -O0 -lrt'"
```

Test case
```js
function foo() {
    "use strict";

    let i = 0;
    do {
        const x = [];

        const t = new RegExp(x, x);

        parseInt(t, t);

        i ++;
    } while (i <= 8);
}

for (let i = 0; i < 16; i++) {
    foo();
}
```

Result:
```
DFG ASSERTION FAILED: Bad data format

WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp(1267) : JSC::GPRReg JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal(JSC::DFG::Edge, JSC::DataFormat&) [with bool strict = false; JSC::GPRReg = JSC::X86Registers::RegisterID]
```

[Radar WebKit Bug Importer]

<rdar://problem/161617852>

[Yusuke Suzuki]

Thanks! This is deterministic release assert crash, so categorizing it to non-security.

[Yusuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/52164

[EWS]

Committed 301359@main (1b8a020d3b82): <https://commits.webkit.org/301359@main>

Reviewed commits have been landed. Closing PR #52164 and removing active labels.