Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7a35a1699bc9a8bf0450993321b16ec73d8f4e04
https://github.com/WebKit/WebKit/commit/7a35a1699bc9a8bf0450993321b16ec73d8f4e04
Author: Sosuke Suzuki <[email protected]>
Date: 2026-06-04 (Thu, 04 Jun 2026)
Changed paths:
A JSTests/stress/wasm-table-constructor-wrapper-function-default.js
M Source/JavaScriptCore/wasm/js/WebAssemblyTableConstructor.cpp
Log Message:
-----------
[Wasm] `Table` constructor should fill funcref tables when the default value
is a wrapper function
https://bugs.webkit.org/show_bug.cgi?id=316280
Reviewed by Yusuke Suzuki.
new WebAssembly.Table({element: "funcref", initial: N}, value) type-checks the
second argument with isWebAssemblyHostFunction, which accepts both
WebAssemblyFunction and WebAssemblyWrapperFunction (a JS function imported into
wasm and re-exported). The fill loop, however, only stored the default value
when it was a WebAssemblyFunction, so a wrapper-function default silently left
every entry null even though the constructor accepted it. The same value passed
to Table.prototype.set or Table.prototype.grow was stored correctly, so the
constructor disagreed with the rest of the JS API. 314219@main fixed the same
pattern on the Table::grow path.
Fix the fill loop to store any non-null funcref default value. The preceding
type check already guarantees that a non-null default on a funcref table is a
WebAssemblyFunctionBase, which is exactly what FuncRefTable::set expects. Since
nothing reads the isWebAssemblyHostFunction out-parameters anymore, switch to
the overload without them.
const wrapper = new WebAssembly.Instance(reexportingModule, { m: { f: () =>
42 } }).exports.f;
const table = new WebAssembly.Table({ element: "funcref", initial: 3 },
wrapper);
table.get(0); // was null, now wrapper
Test: JSTests/stress/wasm-table-constructor-wrapper-function-default.js
* JSTests/stress/wasm-table-constructor-wrapper-function-default.js: Added.
(shouldBe):
(i.shouldBe.caller):
(catch):
* Source/JavaScriptCore/wasm/js/WebAssemblyTableConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
Canonical link: https://commits.webkit.org/314543@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
