290250 2025-03-22 01:33:58 -0700 ASSERTION FAILED: this->variant() != StructureVariant::WebAssemblyGC 2025-04-06 20:42:08 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 katoshi1337 ysuzuki bfulgham webkit-bug-importer ysuzuki oldest_to_newest 2105263 0 katoshi1337 2025-03-22 01:33:58 -0700 Commit: b12ed39572951123a4b5a99c471e0262e9481001 Command: ./jsc ./poc.js PoC: ``` load("wasm-module-builder.js"); const v4 = new WasmModuleBuilder(); const v17 = [kExprI32Const,42,kGCPrefix,kExprStructNew,v4.addStruct([makeField(kWasmI32, false)]),kGCPrefix,kExprExternConvertAny]; v4.addFunction("foo", makeSig([], [kWasmExternRef])).exportFunc().addBody(v17); globalThis.struct = v4.instantiate().exports.foo(); function f31(a32) { a32.prototype = globalThis.struct; new a32(); } function f44() { } f31(f44); ``` Output: ``` ASSERTION FAILED: this->variant() != StructureVariant::WebAssemblyGC /home/test/WebKit/Source/JavaScriptCore/runtime/Structure.cpp(305) : JSC::Structure::Structure(VM &, StructureVariant, Structure *) ``` 2105264 1 webkit-bug-importer 2025-03-22 01:34:07 -0700 <rdar://problem/147638735> 2109264 2 ysuzuki 2025-04-06 14:38:24 -0700 Hi! Can you attach wasm-module-builder.js script? 2109305 3 ysuzuki 2025-04-06 17:17:23 -0700 This is ToT issue. 2109306 4 ysuzuki 2025-04-06 17:19:16 -0700 Pull request: https://github.com/WebKit/WebKit/pull/43722 2109322 5 ews-feeder 2025-04-06 20:42:06 -0700 Committed 293344@main (ccb7cffd3e58): <https://commits.webkit.org/293344@main> Reviewed commits have been landed. Closing PR #43722 and removing active labels.