Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 23c7a806a33e184a9288c84a12aa9bca7fd73f1b
https://github.com/WebKit/WebKit/commit/23c7a806a33e184a9288c84a12aa9bca7fd73f1b
Author: Shu-yu Guo <[email protected]>
Date: 2025-10-27 (Mon, 27 Oct 2025)
Changed paths:
M JSTests/wasm/gc/array_new_elem.js
M Source/JavaScriptCore/wasm/WasmOperationsInlines.h
Log Message:
-----------
[JSC] Fix assert in array.new_elem slow path
https://bugs.webkit.org/show_bug.cgi?id=301466
rdar://163407647
Reviewed by Yusuke Suzuki.
There are 3 elem segment types: passive, active, or declarative. Only passive
elem segments are available at runtime and get a non-nullptr `element`.
array.new_elem can still refer to active and declarative elem segments, usually
this traps, because those element segments would be considered 0-lengthed and
the array being created usually have length > 0. This doesn't trap when the
array size is 0, but in that case the `element` is a nullptr and the debug
asserts crash. This PR fixes the asserts to allow the array to be 0-lengthed.
New test cases are added to array_new_elem.js
Canonical link: https://commits.webkit.org/302224@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
