Assertion Failure: offset != 0 in ChakraCore/lib/Backend/amd64/EncoderMD.cpp, line 263

## Version
commit id: c3ead3f8a6e0bb8e32e043adc091c68cba5935e9

## Platform
Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

## Build
- Debug Mode

```
./build.sh --debug --static
```

## PoC
```
async function f1() {
const v7 = await 1301655991;
function f8() {
return v7;
}
f8();
for (let v13 = 0; v13 < 10; v13++) {
function f14() {}
}
}
for (let v0 = 0; v0 < 100; v0++) {
f1();
}
```

## Execution steps & Output
```
./ch --maxinterpretcount:10 --maxsimplejitruncount:100 -bgjit- poc.js
ASSERTION 386721: (/home/wjm/ChakraCore/lib/Backend/amd64/EncoderMD.cpp, line 263) offset != 0
Failure: (offset != 0)
Signal: SIGILL (Illegal instruction)
```
## Backtrace
```
(lldb) bt
* thread #1, name = 'ch', stop reason = signal SIGILL: illegal instruction operand
* frame #0: 0x0000555556962c87 ch`EncoderMD::GetMod(this=0x00007fffffffa230, symOpnd=0x00007ff7e7bbbf58, pDispSize=0x00007fffffff8b28, rmReg=0x00007fffffff8b01) at EncoderMD.cpp:263:9
frame #1: 0x0000555556962f7d ch`EncoderMD::EmitModRM(this=0x00007fffffffa230, instr=0x00007ff7e7c0bd90, opnd=0x00007ff7e7bbbf58, reg1='\b') at EncoderMD.cpp:345:21
frame #2: 0x00005555569655a6 ch`EncoderMD::Encode(this=0x00007fffffffa230, instr=0x00007ff7e7c0bd90, pc="\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe"..., beginCodeAddress="H\xb8\x90p\xebWUU") at EncoderMD.cpp:898:37
frame #3: 0x0000555556aec202 ch`Encoder::Encode(this=0x00007fffffffa228) at Encoder.cpp:223:33
frame #4: 0x0000555556b26a22 ch`Func::TryCodegen(this=0x00007fffffffb1f0) at Func.cpp:561:17
frame #5: 0x0000555556b25ae0 ch`Func::Codegen(alloc=0x00007fffffffb7b0, workItem=0x00007ff7e7bf4030, threadContextInfo=0x0000555557eb6fe8, scriptContextInfo=0x0000555557ee8f68, outputData=0x00007fffffffbbf0, epInfo=0x00007ff7e7c48240, runtimeInfo=0x0000000000000000, polymorphicInlineCacheInfo=0x00007ff7e7b15fc0, codeGenAllocators=0x0000555557ef8008, codeGenProfiler=0x0000000000000000, isBackgroundJIT=false) at Func.cpp:325:18
frame #6: 0x000055555690ef90 ch`NativeCodeGenerator::CodeGen(this=0x0000555557eea738, pageAllocator=0x0000555557eb7370, workItemData=0x0000555557ef7360, jitWriteData=0x00007fffffffbbf0, foreground=true, epInfo=0x00007ff7e7c48240) at NativeCodeGenerator.cpp:890:9
frame #7: 0x0000555556910c28 ch`NativeCodeGenerator::CodeGen(this=0x0000555557eea738, pageAllocator=0x0000555557eb7370, workItem=0x0000555557ef7338, foreground=true) at NativeCodeGenerator.cpp:1007:5
frame #8: 0x0000555556913a24 ch`NativeCodeGenerator::Process(this=0x0000555557eea738, job=0x0000555557ef7340, threadData=0x0000000000000000) at NativeCodeGenerator.cpp:1907:13
frame #9: 0x00005555569b83d4 ch`JsUtil::ForegroundJobProcessor::Process(job=0x0000555557ef7340) at Jobs.cpp:426:36
frame #10: 0x0000555556920e29 ch`void JsUtil::ForegroundJobProcessor::PrioritizeJobAndWait(this=0x0000555557ea2ce8, manager=0x0000555557eea738, holder=0x00007ff7e7c48240, function=0x00007ff7e7c76730) at Jobs.inl:207:36
frame #11: 0x00005555569182e4 ch`void JsUtil::JobProcessor::PrioritizeJobAndWait(this=0x0000555557ea2ce8, manager=0x0000555557eea738, holder=0x00007ff7e7c48240, function=0x00007ff7e7c76730) at Jobs.inl:81:58
frame #12: 0x0000555556912786 ch`NativeCodeGenerator::CheckCodeGen(function=0x00007ff7e7c76730) at NativeCodeGenerator.cpp:1644:37
frame #13: 0x0000555556978bac ch`NativeCodeGenerator::CheckCodeGenThunk(Js::RecyclableObject*, Js::CallInfo, ...) at Thunks.S:36
frame #14: 0x00005555564a37de ch`amd64_CallFunction at JavascriptFunctionA.S:100
frame #15: 0x00005555561d7a4b ch`void* Js::JavascriptFunction::CallFunction(function=0x00007ff7e7c76730, entryPoint=(ch`NativeCodeGenerator::CheckCodeGenThunk(Js::RecyclableObject*, Js::CallInfo, ...)), args=Arguments @ 0x00007fffffffc100, useLargeArgCount=false)(Js::RecyclableObject*, Js::CallInfo, ...), Js::Arguments, bool) at JavascriptFunction.cpp:1364:16
frame #16: 0x00005555561da48f ch`Js::JavascriptGenerator::CallGenerator(this=0x00007ff7e7c442a0, data=0x000100004d95b1b7, resumeKind=Normal) at JavascriptGenerator.cpp:198:26
frame #17: 0x00005555561a8db4 ch`Js::JavascriptAsyncFunction::EntryAsyncSpawnStepNextFunction(function=0x00007ff7e7b1a460, callInfo=(Count = 1, Flags = CallFlags_Value, unused = 0)) at JavascriptAsyncFunction.cpp:93:31
frame #18: 0x00005555561a8f98 ch`Js::JavascriptAsyncFunction::AsyncSpawnStep(stepFunction=0x00007ff7e7b1a460, generator=0x00007ff7e7c442a0, resolve=0x00007ff7e7c4f060, reject=0x00007ff7e7c4f0c0) at JavascriptAsyncFunction.cpp:151:25
frame #19: 0x00005555561a99b6 ch`Js::JavascriptAsyncFunction::EntryAsyncSpawnCallStepFunction(function=0x00007ff7e7c4b4d0, callInfo=(Count = 2, Flags = CallFlags_Value, unused = 0)) at JavascriptAsyncFunction.cpp:130:5
frame #20: 0x00005555563a0164 ch`Js::JavascriptPromise::EntryReactionTaskFunction(function=0x00007ff7e7c65050, callInfo=(Count = 1, Flags = CallFlags_None, unused = 0)) at JavascriptPromise.cpp:1273:37
frame #21: 0x00005555564a37de ch`amd64_CallFunction at JavascriptFunctionA.S:100
frame #22: 0x00005555561d7a4b ch`void* Js::JavascriptFunction::CallFunction(function=0x00007ff7e7c65050, entryPoint=(ch`Js::JavascriptPromise::EntryReactionTaskFunction(Js::RecyclableObject*, Js::CallInfo, ...) at JavascriptPromise.cpp:1236), args=Arguments @ 0x00007fffffffc8b8, useLargeArgCount=false)(Js::RecyclableObject*, Js::CallInfo, ...), Js::Arguments, bool) at JavascriptFunction.cpp:1364:16
frame #23: 0x00005555561cf2f4 ch`Js::JavascriptFunction::CallRootFunctionInternal(obj=0x00007ff7e7c65050, args=Arguments @ 0x00007fffffffc930, scriptContext=0x0000555557ee8f68, inScript=true) at JavascriptFunction.cpp:772:24
frame #24: 0x00005555561cf10c ch`Js::JavascriptFunction::CallRootFunction(obj=0x00007ff7e7c65050, args=, scriptContext=0x0000555557ee8f68, inScript=true) at JavascriptFunction.cpp:717:15
frame #25: 0x00005555561cf0b1 ch`Js::JavascriptFunction::CallRootFunction(this=0x00007ff7e7c65050, args=, scriptContext=0x0000555557ee8f68, inScript=true) at JavascriptFunction.cpp:832:16
frame #26: 0x000055555588add5 ch`JsCallFunction::$_67::operator(this=0x00007fffffffcda0, scriptContext=0x0000555557ee8f68, _actionEntryPopper=0x00007fffffffcd80)(Js::ScriptContext*, TTD::TTDJsRTActionResultAutoRecorder&) const at Jsrt.cpp:2842:41
frame #27: 0x000055555588a764 ch`_JsErrorCode ContextAPIWrapper(this=0x00007fffffffcd38, scriptContext=0x0000555557ee8f68)::'lambda'(Js::ScriptContext*)::operator()(Js::ScriptContext*) const at JsrtInternal.h:237:16
frame #28: 0x000055555588a104 ch`_JsErrorCode ContextAPIWrapper_Core(JsCallFunction::$_67)::'lambda'(Js::ScriptContext*)>(fn=(anonymous class) @ 0x00007fffffffcd38) at JsrtInternal.h:192:23
frame #29: 0x000055555585f1b6 ch`_JsErrorCode ContextAPIWrapper(fn=(anonymous class) @ 0x00007fffffffcda0) at JsrtInternal.h:235:27
frame #30: 0x000055555585f179 ch`::JsCallFunction(function=0x00007ff7e7c65050, args=0x00007fffffffce70, cargs=1, result=0x00007fffffffce68) at Jsrt.cpp:2804:12
frame #31: 0x000055555578bf80 ch`ChakraRTInterface::JsCallFunction(function=0x00007ff7e7c65050, arguments=0x00007fffffffce70, argumentCount=1, result=0x00007fffffffce68) at ChakraRtInterface.h:416:149
frame #32: 0x0000555555797a7a ch`WScriptJsrt::CallbackMessage::CallFunction(this=0x0000555557effbb0, fileName="bug14_offset.js") at WScriptJsrt.cpp:2009:21
frame #33: 0x000055555579795d ch`WScriptJsrt::CallbackMessage::Call(this=0x0000555557effbb0, fileName="bug14_offset.js") at WScriptJsrt.cpp:1980:12
frame #34: 0x00005555557872fe ch`MessageQueue::ProcessAll(this=0x0000555557ef4920, fileName="bug14_offset.js") at MessageQueue.h:256:18
frame #35: 0x000055555578499c ch`RunScript(fileName="bug14_offset.js", fileContents="async function f1() {\n const v7 = await 1301655991;\n function f8() {\n return v7;\n }\n f8();\n for (let v13 = 0; v13 < 10; v13++) {\n function f14() {}\n }\n}\nfor (let v0 = 0; v0 < 100; v0++) {\n f1();\n}\n// CRASH INFO\n// ==========\n// TERMSIG: 4\n// STDERR:\n// ASSERTION 3167571: (/home/wjm/ChakraCore/lib/Backend/amd64/EncoderMD.cpp, line 263) offset != 0\n// Failure: (offset != 0)\n// STDOUT:\n// ARGS: /home/wjm/ChakraCore/out/Debug/ch --maxinterpretcount:10 --maxsimplejitruncount:100 -bgjit- -reprl fuzzcode.js\n// EXECUTION TIME: 180 ms\n\n\n/*\n\nTitle: \n\n## Version\ncommit id: c3ead3f8a6e0bb8e32e043adc091c68cba5935e9\n\n## Platform\nUbuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)\n\n## Build\n- Debug Mode\n\n```\n./build.sh --debug --static\n```\n\n## PoC\n```\n\n```\n\n## Execution steps & Output\n```\n./ch --maxinterpretcount:10 --maxsimplejitruncount:100 -bgjit- poc.js\nAborted (core dumped)\n```\n## Backtrace\n```\n\n\n```\n\n*\/", fileLength=943, fileContentsFinalizeCallback=(ch`WScriptJsrt::FinalizeFree(void*) at WScriptJsrt.cpp:217), bufferValue=0x0000000000000000, fullPath="/home/wjm/DiTing-pocs/chakra/bug14_offset.js", parserStateCache=0x0000000000000000)(void*), void*, char*, void*) at ch.cpp:480:17
frame #36: 0x00005555557863f0 ch`ExecuteTest(fileName="bug14_offset.js") at ch.cpp:917:13
frame #37: 0x00005555557864ac ch`ExecuteTestWithMemoryCheck(fileName="bug14_offset.js") at ch.cpp:967:10
frame #38: 0x0000555555786d7a ch`main(argc=5, c_argv=0x00007fffffffd648) at ch.cpp:1274:20
frame #39: 0x00007ffff778d1e2 libc.so.6`__libc_start_main + 242
frame #40: 0x0000555555783b7e ch`_start + 46

```