Bug 290250 – ASSERTION FAILED: this->variant() != StructureVariant::WebAssemblyGC

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

Commit:

b12ed39572951123a4b5a99c471e0262e9481001

Command:

./jsc ./poc.js


PoC:


```
load("wasm-module-builder.js");
const v4 = new WasmModuleBuilder();
const v17 = [kExprI32Const,42,kGCPrefix,kExprStructNew,v4.addStruct([makeField(kWasmI32, false)]),kGCPrefix,kExprExternConvertAny];

v4.addFunction("foo", makeSig([], [kWasmExternRef])).exportFunc().addBody(v17);
globalThis.struct = v4.instantiate().exports.foo();
function f31(a32) {
    a32.prototype = globalThis.struct;
    new a32();
}
function f44() {
}
f31(f44);

```


Output:
```
ASSERTION FAILED: this->variant() != StructureVariant::WebAssemblyGC
/home/test/WebKit/Source/JavaScriptCore/runtime/Structure.cpp(305) : JSC::Structure::Structure(VM &, StructureVariant, Structure *)

```

[Radar WebKit Bug Importer]

<rdar://problem/147638735>

[Yusuke Suzuki]

Hi! Can you attach wasm-module-builder.js script?

[Yusuke Suzuki]

This is ToT issue.

[Yusuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/43722

[EWS]

Committed 293344@main (ccb7cffd3e58): <https://commits.webkit.org/293344@main>

Reviewed commits have been landed. Closing PR #43722 and removing active labels.