Preparser

V8’s fast, lazy scanner that skims function bodies without building a full AST to speed up parsing; it must reach the same syntactic conclusions as the full parser or the two disagree.

Contextual keywords `eval` / `arguments`

identifiers that are legal names generally but are forbidden as binding targets in strict mode, so the parser must recognize them even when spelled with Unicode escapes.

`literal_contains_escapes()`

a scanner flag that is true when the just-scanned identifier used escape sequences (e.g. a for a), used to distinguish arguments from arguments.

`PreParserIdentifier`

the preparser’s lightweight identifier token whose kind (Eval, Arguments, Default, …) drives strict-mode binding checks.

1. Craft escaped-keyword source Author strict-mode code that binds the arguments keyword using a Unicode escape, e.g. "use strict"; function f(a){ var arguments = 0; }, as in the message test.
2. Trigger lazy preparse Arrange for the enclosing function to be preparsed lazily so the vulnerable PreParserIdentifier classification runs and returns Default for arguments, accepting the binding.
3. Trigger later full parse When the function is fully parsed/compiled, the parser classifies arguments as arguments, disagreeing with the preparse result about scope and binding validity.
4. Induce parser/preparser state mismatch The differing classification yields inconsistent scope/variable metadata for the function, the type-confusion condition the advisory reports (inferred as to the exact confused object).
5. Leverage the confusion The inconsistent scope/binding state is manipulated into a type confusion in later object handling (inferred; the patch does not show the downstream sink).

• src/parsing/preparser.cc
• test/message/fail/preparse-arguments.js
• test/message/fail/preparse-arguments.out

• Escape-sensitive keyword checks
  Hunt for other places that use literal_contains_escapes() or raw-vs-decoded comparisons to accept/reject contextual keywords (eval, arguments, yield, await, let, static), where escapes could hide a reserved word.
• Preparser/parser divergence
  Systematically diff preparser identifier and binding logic against the full parser.cc equivalents; any predicate present in one but not the other is a candidate for scope/type confusion.
• Strict-mode binding validation
  Audit strict-mode “Unexpected eval or arguments” enforcement across lazy and eager paths to ensure both reject the same set of (possibly escaped) identifiers.

Debug check failed: IsInBounds(index)

#
# Fatal error in ../../src/objects/fixed-array-inl.h, line 116
# Debug check failed: IsInBounds(index).
#
#
#
#FailureMessage Object: 0x7ffdb6786b58
==== C stack trace ===============================

    /home/user/v8/v8/out/x64.debug/libv8_libbase.so(v8::base::debug::StackTrace::StackTrace()+0x1e) [0x7f64fec3792e]
    /home/user/v8/v8/out/x64.debug/libv8_libplatform.so(+0x4b60d) [0x7f64feba460d]
    /home/user/v8/v8/out/x64.debug/libv8_libbase.so(V8_Fatal(char const*, int, char const*, ...)+0x205) [0x7f64fec10ce5]
    /home/user/v8/v8/out/x64.debug/libv8_libbase.so(+0x4d69c) [0x7f64fec1069c]
    /home/user/v8/v8/out/x64.debug/libv8_libbase.so(V8_Dcheck(char const*, int, char const*)+0x4d) [0x7f64fec10dbd]
    /home/user/v8/v8/out/x64.debug/libv8.so(v8::internal::TaggedArrayBase<v8::internal::WeakFixedArray, v8::internal::WeakFixedArrayShape, v8::internal::HeapObjectLayout>::get(int) const+0x47) [0x7f650670c1b7]
    /home/user/v8/v8/out/x64.debug/libv8.so(void v8::internal::DeclarationScope::AllocateScopeInfos<v8::internal::Isolate>(v8::internal::ParseInfo*, v8::internal::DirectHandle<v8::internal::Script>, v8::internal::Isolate*)+0x2ec) [0x7f650670ab0c]
    /home/user/v8/v8/out/x64.debug/libv8.so(+0x7c0ac9b) [0x7f6506853c9b]
    /home/user/v8/v8/out/x64.debug/libv8.so(v8::internal::Compiler::Compile(v8::internal::Isolate*, v8::internal::Handle<v8::internal::SharedFunctionInfo>, v8::internal::Compiler::ClearExceptionFlag, v8::internal::IsCompiledScope*, v8::internal::CreateSourcePositions)+0x9f0) [0x7f65068537a0]
    /home/user/v8/v8/out/x64.debug/libv8.so(v8::internal::Compiler::Compile(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::Compiler::ClearExceptionFlag, v8::internal::IsCompiledScope*)+0x4f0) [0x7f6506854730]
    /home/user/v8/v8/out/x64.debug/libv8.so(+0x8e5a176) [0x7f6507aa3176]
    /home/user/v8/v8/out/x64.debug/libv8.so(v8::internal::Runtime_CompileLazy(int, unsigned long*, v8::internal::Isolate*)+0x151) [0x7f6507aa2bb1]
    /home/user/v8/v8/out/x64.debug/libv8.so(+0x6fca53d) [0x7f6505c1353d]
Trace/breakpoint trap (core dumped)