266249 2023-12-11 13:12:05 -0800 [Wasm-GC] Avoid spurious assertion in JSWebAssemblyArray::set 2024-01-05 18:13:20 -0800 1 1 1 Unclassified WebKit WebAssembly WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 asumu webkit-unassigned webkit-bug-importer oldest_to_newest 1998772 0 asumu 2023-12-11 13:12:05 -0800 Example code (contributed by Zalim Bashorov): ``` (module ;; Test with a subtype as well. (type (sub (array (mut i16)))) (global (mut (ref null 0)) (ref.null 0)) (func (export "init") (global.set 0 (array.new 0 (i32.const 42) (i32.const 5))) (array.set 0 (global.get 0) (i32.const 3) (i32.and (i32.const 84) (i32.const 0xFFFF)))) (func (export "get") (param i32) (result i32) (array.get_u 0 (global.get 0) (local.get 0))) ) ``` This currently crashes in debug builds due to a spurious assertion in the array.set implementation. 1998781 1 asumu 2023-12-11 13:36:26 -0800 Pull request: https://github.com/WebKit/WebKit/pull/21650 2000508 2 asumu 2023-12-18 13:11:56 -0800 Pull request: https://github.com/WebKit/WebKit/pull/21926 2000510 3 webkit-bug-importer 2023-12-18 13:13:12 -0800 <rdar://problem/119830822> 2003305 4 ews-feeder 2024-01-05 18:13:18 -0800 Committed 272719@main (1e4c23e67107): <https://commits.webkit.org/272719@main> Reviewed commits have been landed. Closing PR #21650 and removing active labels.