Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 13ada10535a452a15c0734938f3c3e5eb1390a0e
https://github.com/WebKit/WebKit/commit/13ada10535a452a15c0734938f3c3e5eb1390a0e
Author: Sergey Rubanov <[email protected]>
Date: 2026-08-03 (Mon, 03 Aug 2026)
Changed paths:
M JSTests/wasm/gc/no-gc-structure-transition.js
M Source/JavaScriptCore/jsc.cpp
M Source/JavaScriptCore/tools/JSDollarVM.cpp
Log Message:
-----------
[JSC] Avoid ensureArrayStorage transition on Wasm GC objects
https://bugs.webkit.org/show_bug.cgi?id=319087
Reviewed by Keith Miller.
The jsc and $vm ensureArrayStorage test helpers passed any object to
ensureArrayStorage. Wasm GC objects have no butterfly, so that path
transitioned Structure and hit RELEASE_ASSERT on WebAssemblyGCStructure.
Only call it for JSObjectWithButterfly.
* Source/JavaScriptCore/jsc.cpp:
(JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/tools/JSDollarVM.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* JSTests/wasm/gc/no-gc-structure-transition.js:
(testEnsureArrayStorage):
(testEnsureArrayStorageViaWasmImport):
Canonical link: https://commits.webkit.org/318462@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
