Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ccb7cffd3e5852a18766675da4fc03a003e7f8bf
https://github.com/WebKit/WebKit/commit/ccb7cffd3e5852a18766675da4fc03a003e7f8bf
Author: Yusuke Suzuki <[email protected]>
Date: 2025-04-06 (Sun, 06 Apr 2025)
Changed paths:
A JSTests/wasm/stress/wasmgc-struct-may-do-transition.js
M Source/JavaScriptCore/CMakeLists.txt
M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
M Source/JavaScriptCore/runtime/Structure.cpp
M Source/JavaScriptCore/runtime/StructureInlines.h
M Source/JavaScriptCore/wasm/js/WebAssemblyGCStructure.cpp
M Source/JavaScriptCore/wasm/js/WebAssemblyGCStructure.h
Log Message:
-----------
ASSERTION FAILED: this->variant() != StructureVariant::WebAssemblyGC
https://bugs.webkit.org/show_bug.cgi?id=290250
rdar://147638735
Reviewed by Keith Miller.
WebAssemblyGCStructure can do transition. One example is mayBePrototype
transition which happens when the wasm GC object is used for
[[Prototype]] of some random objects. Thus we must support structure
transition as the same to the other structures.
* JSTests/wasm/stress/wasmgc-struct-may-do-transition.js: Added.
* Source/JavaScriptCore/runtime/Structure.cpp:
(JSC::Structure::Structure):
* Source/JavaScriptCore/runtime/StructureInlines.h:
(JSC::Structure::create):
* Source/JavaScriptCore/wasm/js/WebAssemblyGCStructure.cpp:
(JSC::WebAssemblyGCStructure::WebAssemblyGCStructure):
* Source/JavaScriptCore/wasm/js/WebAssemblyGCStructure.h:
Canonical link: https://commits.webkit.org/293344@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
