tor-browser

commit 44cd302ef0dc5e02915cf44019d64b8d12d31722
parent 621b1c494173bd4af08cbf55a0b3248bc56e0fcc
Author: Julian Seward <jseward@acm.org>
Date:   Tue, 21 Oct 2025 08:49:12 +0000

Bug 1993803.  r=rhunt.

Differential Revision: https://phabricator.services.mozilla.com/D268920

Diffstat:
M
js/src/jit/MIR-wasm.h
 | 
7
+++++++

1 file changed, 7 insertions(+), 0 deletions(-)
diff --git a/js/src/jit/MIR-wasm.h b/js/src/jit/MIR-wasm.h
@@ -2577,6 +2577,13 @@ class MWasmLoadField : public MBinaryInstruction, public NoTypePolicy::Data {
       setMovable();
     }
     initWasmRefType(maybeRefType);
+    if (aliases_.flags() ==
+            AliasSet::Load(AliasSet::WasmStructOutlineDataPointer).flags() ||
+        aliases_.flags() ==
+            AliasSet::Load(AliasSet::WasmArrayDataPointer).flags()) {
+      aliases_ = AliasSet::Store(AliasSet::Any);
+      setNotMovableUnchecked();
+    }
   }
 
  public: