From 6ec6324056f8a975fe216e4973c58add48adf70b Mon Sep 17 00:00:00 2001
From: win7-7 <win7-7@users.noreply.github.com>
Date: Tue, 30 Dec 2025 01:37:40 +0200
Subject: [PATCH]  1331452 -  jit-test/tests/debug/wasm-06.js failures with CGC
 builds

1331452 - Keep scope in a slot in WasmFunctionCallObjects.

1331452 - Followup: hazard fix.
---
 js/src/vm/EnvironmentObject.cpp |  3 ++-
 js/src/vm/EnvironmentObject.h   | 10 ++++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/js/src/vm/EnvironmentObject.cpp b/js/src/vm/EnvironmentObject.cpp
index 1c87e552ca..5ea7971e0e 100644
--- a/js/src/vm/EnvironmentObject.cpp
+++ b/js/src/vm/EnvironmentObject.cpp
@@ -633,7 +633,7 @@ const Class WasmFunctionCallObject::class_ = {
 };
 
 /* static */ WasmFunctionCallObject*
-WasmFunctionCallObject::createHollowForDebug(JSContext* cx, WasmFunctionScope* scope)
+WasmFunctionCallObject::createHollowForDebug(JSContext* cx, Handle<WasmFunctionScope*> scope)
 {
     RootedObjectGroup group(cx, ObjectGroup::defaultNewGroup(cx, &class_, TaggedProto(nullptr)));
     if (!group)
@@ -652,6 +652,7 @@ WasmFunctionCallObject::createHollowForDebug(JSContext* cx, WasmFunctionScope* s
 
     Rooted<WasmFunctionCallObject*> callobj(cx, &obj->as<WasmFunctionCallObject>());
     callobj->initEnclosingEnvironment(&cx->global()->lexicalEnvironment());
+    callobj->initReservedSlot(SCOPE_SLOT, PrivateGCThingValue(scope));
 
     return callobj;
 }
diff --git a/js/src/vm/EnvironmentObject.h b/js/src/vm/EnvironmentObject.h
index 63eded443b..4c7e53adcc 100644
--- a/js/src/vm/EnvironmentObject.h
+++ b/js/src/vm/EnvironmentObject.h
@@ -427,13 +427,19 @@ typedef MutableHandle<ModuleEnvironmentObject*> MutableHandleModuleEnvironmentOb
 
 class WasmFunctionCallObject : public EnvironmentObject
 {
+  // Currently WasmFunctionCallObjects do not use their scopes in a
+    // meaningful way. However, it is an invariant of DebugEnvironments that
+    // environments kept in those maps have live scopes, thus this strong
+    // reference.
+    static const uint32_t SCOPE_SLOT = 1;
+
   public:
     static const Class class_;
 
-    static const uint32_t RESERVED_SLOTS = 1;
+    static const uint32_t RESERVED_SLOTS = 2;
 
     static WasmFunctionCallObject* createHollowForDebug(JSContext* cx,
-                                                        WasmFunctionScope* scope);
+                                                        Handle<WasmFunctionScope*> scope);
 };
 
 class LexicalEnvironmentObject : public EnvironmentObject