Wasm `table.get` inlined into BBQ and OMG

Component: JSC WebAssembly JIT tiers | 798b6ba

Wasm tables backing externref/anyref hold JS values in a WriteBarrier<Unknown> array, ExternOrAnyRefTable::m_jsValues, and table.get must bounds-check the index against the table's current length before indexing into it. Previously both BBQ and OMG delegated that entirely to operationGetWasmTableElement, a single C++ runtime function whose bounds check only had to be correct once.

Now each tier implements its own inline version. BBQ loads the Table* and length into scratch registers and branches differently depending on whether the index is a compile-time constant or held in a register, then performs a BaseIndex(table, index, ×8) load from m_jsValues. OMG instead builds a single B3 Check(AboveEqual(index, ZExt32(length))) node and computes the load address as jsValues + (index << 3); there the constant-versus-register distinction only narrows which slice of the m_jsValues abstract heap is used for alias analysis, not the bounds-check logic itself. The funcref path still goes through the runtime call.

Significance

A security-relevant bounds check moves out of one well-audited C++ helper into hand-written machine code emitted independently by two separate JIT tiers. The call-based path also remains for funcref, so the codebase now carries three implementations of the same check where it previously carried one.

Audit directions

The forward-facing pattern is a runtime helper whose safety check gets inlined into a JIT tier, duplicating a single point of correctness across generators that evolve separately. Audit the other operations that have been pulled out of operation* helpers into BBQ and OMG emission for whether the inline check reproduces the helper's semantics exactly — particularly around index width, since the helper receives a value already normalized by the call ABI while inline code must handle the raw register. The code-review tell is a BBQ constant-index fast path and an OMG Check(AboveEqual(...)) for the same opcode that were written at different times: any divergence between the two is a bug in one of them.

---