[webkit-changes] [WebKit/WebKit] febd68: [Wasm-GC] Fix refcounts for compound type definitions

[Asumu Takikawa]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: febd6818b5b7c349cdf7dcd04c387eedbba87fde
      https://github.com/WebKit/WebKit/commit/febd6818b5b7c349cdf7dcd04c387eedbba87fde
  Author: Asumu Takikawa <asumu at igalia.com>
  Date:   2022-11-17 (Thu, 17 Nov 2022)

  Changed paths:
    A JSTests/wasm/gc/bug247874.js
    M Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp
    M Source/JavaScriptCore/wasm/WasmTypeDefinition.h

  Log Message:
  -----------
  [Wasm-GC] Fix refcounts for compound type definitions
https://bugs.webkit.org/show_bug.cgi?id=247874

Reviewed by Yusuke Suzuki.

Compound type definitions that use type indices to refer to other types
need to ref/deref the referred type definitions in order to keep them
live (since the module's type signature list will not necessarily hold
these types). Type definitions that only hold value types such as
functions or arrays are fine as-is.

* JSTests/wasm/gc/bug247874.js: Added.
(i.instantiate.module.type.struct.type.sub.0.struct.field.i32.global.import.string_appeared_here.string_appeared_here):
(i.instantiate.module.rec.type.struct.type.func.global.import.string_appeared_here.string_appeared_here):
* Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp:
(JSC::Wasm::Subtype::cleanup):
(JSC::Wasm::Projection::cleanup):
(JSC::Wasm::RecursionGroup::cleanup):
(JSC::Wasm::TypeDefinition::cleanup):
(JSC::Wasm::RecursionGroupParameterTypes::translate):
(JSC::Wasm::ProjectionParameterTypes::translate):
(JSC::Wasm::SubtypeParameterTypes::translate):
(JSC::Wasm::TypeInformation::tryCleanup):
* Source/JavaScriptCore/wasm/WasmTypeDefinition.h:

Canonical link: https://commits.webkit.org/256800@main