From 1f76c9c036dae66f6bca211d2e30080bb69e0d8c Mon Sep 17 00:00:00 2001
From: win7-7 <win7-7@users.noreply.github.com>
Date: Tue, 30 Dec 2025 14:47:03 +0200
Subject: [PATCH] 1325480 - Baldr: make WasmInstanceObject::ExportMap a strong
 edge

1325480 - Baldr: make WasmInstanceObject::ExportMap a strong edge
---
 js/src/wasm/WasmJS.cpp | 12 +++++++-----
 js/src/wasm/WasmJS.h   | 12 ++++++------
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
index 52addf774b..36b49f3a6c 100644
--- a/js/src/wasm/WasmJS.cpp
+++ b/js/src/wasm/WasmJS.cpp
@@ -912,8 +912,10 @@ WasmInstanceObject::finalize(FreeOp* fop, JSObject* obj)
 /* static */ void
 WasmInstanceObject::trace(JSTracer* trc, JSObject* obj)
 {
-    if (!obj->as<WasmInstanceObject>().isNewborn())
-        obj->as<WasmInstanceObject>().instance().tracePrivate(trc);
+    WasmInstanceObject& instanceObj = obj->as<WasmInstanceObject>();
+    instanceObj.exports().trace(trc);
+    if (!instanceObj.isNewborn())
+        instanceObj.instance().tracePrivate(trc);
 }
 
 /* static */ WasmInstanceObject*
@@ -926,7 +928,7 @@ WasmInstanceObject::create(JSContext* cx,
                            const ValVector& globalImports,
                            HandleObject proto)
 {
-    UniquePtr<WeakExportMap> exports = js::MakeUnique<WeakExportMap>(cx->zone(), ExportMap());
+    UniquePtr<ExportMap> exports = js::MakeUnique<ExportMap>();
     if (!exports || !exports->init()) {
         ReportOutOfMemory(cx);
         return nullptr;
@@ -1026,10 +1028,10 @@ WasmInstanceObject::instance() const
     return *(Instance*)getReservedSlot(INSTANCE_SLOT).toPrivate();
 }
 
-WasmInstanceObject::WeakExportMap&
+WasmInstanceObject::ExportMap&
 WasmInstanceObject::exports() const
 {
-    return *(WeakExportMap*)getReservedSlot(EXPORTS_SLOT).toPrivate();
+    return *(ExportMap*)getReservedSlot(EXPORTS_SLOT).toPrivate();
 }
 
 WasmInstanceObject::WeakScopeMap&
diff --git a/js/src/wasm/WasmJS.h b/js/src/wasm/WasmJS.h
index 7e19136c43..1b38285bac 100644
--- a/js/src/wasm/WasmJS.h
+++ b/js/src/wasm/WasmJS.h
@@ -154,15 +154,15 @@ class WasmInstanceObject : public NativeObject
     static void finalize(FreeOp* fop, JSObject* obj);
     static void trace(JSTracer* trc, JSObject* obj);
 
-    // ExportMap maps from function index to exported function object.
-    // This allows the instance to lazily create exported function
-    // just to ensure a unique object identity for any given function object.
+    // ExportMap maps from function index to exported function
+    // object. This allows the instance to lazily create exported function
+    // objects on demand (instead up-front for all table elements) while
+    // correctly preserving observable function object identity.
     using ExportMap = GCHashMap<uint32_t,
-                                ReadBarrieredFunction,
+                                HeapPtr<JSFunction*>,
                                 DefaultHasher<uint32_t>,
                                 SystemAllocPolicy>;
-    using WeakExportMap = JS::WeakCache<ExportMap>;
-    WeakExportMap& exports() const;
+    ExportMap& exports() const;
 
     // WeakScopeMap maps from function index to js::Scope. This maps is weak
     // to avoid holding scope objects alive. The scopes are normally created