Bug 266249 – [Wasm-GC] Avoid spurious assertion in JSWebAssemblyArray::set

• Component: WebAssembly
• Status: RESOLVED FIXED

[Asumu Takikawa]

Example code (contributed by Zalim Bashorov):

```
(module
        ;; Test with a subtype as well.
        (type (sub (array (mut i16))))
        (global (mut (ref null 0)) (ref.null 0))
        (func (export "init")
          (global.set 0 (array.new 0 (i32.const 42) (i32.const 5)))
          (array.set 0 (global.get 0) (i32.const 3) (i32.and (i32.const 84) (i32.const 0xFFFF))))
        (func (export "get") (param i32) (result i32)
          (array.get_u 0 (global.get 0) (local.get 0)))
      )
```

This currently crashes in debug builds due to a spurious assertion in the array.set implementation.

[Asumu Takikawa]

Pull request: https://github.com/WebKit/WebKit/pull/21650

[Asumu Takikawa]

Pull request: https://github.com/WebKit/WebKit/pull/21926

[Radar WebKit Bug Importer]

<rdar://problem/119830822>

[EWS]

Committed 272719@main (1e4c23e67107): <https://commits.webkit.org/272719@main>

Reviewed commits have been landed. Closing PR #21650 and removing active labels.