Bug 290250
| Summary: | ASSERTION FAILED: this->variant() != StructureVariant::WebAssemblyGC | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | katoshi1337 |
| Component: | JavaScriptCore | Assignee: | Yusuke Suzuki <ysuzuki> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | bfulgham, webkit-bug-importer, ysuzuki |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
katoshi1337
Commit:
b12ed39572951123a4b5a99c471e0262e9481001
Command:
./jsc ./poc.js
PoC:
```
load("wasm-module-builder.js");
const v4 = new WasmModuleBuilder();
const v17 = [kExprI32Const,42,kGCPrefix,kExprStructNew,v4.addStruct([makeField(kWasmI32, false)]),kGCPrefix,kExprExternConvertAny];
v4.addFunction("foo", makeSig([], [kWasmExternRef])).exportFunc().addBody(v17);
globalThis.struct = v4.instantiate().exports.foo();
function f31(a32) {
a32.prototype = globalThis.struct;
new a32();
}
function f44() {
}
f31(f44);
```
Output:
```
ASSERTION FAILED: this->variant() != StructureVariant::WebAssemblyGC
/home/test/WebKit/Source/JavaScriptCore/runtime/Structure.cpp(305) : JSC::Structure::Structure(VM &, StructureVariant, Structure *)
```
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/147638735>
Yusuke Suzuki
Hi! Can you attach wasm-module-builder.js script?
Yusuke Suzuki
This is ToT issue.
Yusuke Suzuki
Pull request: https://github.com/WebKit/WebKit/pull/43722
EWS
Committed 293344@main (ccb7cffd3e58): <https://commits.webkit.org/293344@main>
Reviewed commits have been landed. Closing PR #43722 and removing active labels.