From 533bed9f375d7663d99273ab3a9b4843bcde9928 Mon Sep 17 00:00:00 2001
From: Andreas Haas <[email protected]>
Date: Wed, 15 Apr 2026 06:59:04 -0700
Subject: [PATCH] [wasm] Iterate all references of WasmMemoryMapDescriptor

The WasmMemoryMapDescriptor is a subclass of JSObject, and therefore has
to iterate all potential outgoing references of JSObject.

The CL was made by CodeMender.

Bug: 498818402
Change-Id: I20199d492e4f5ca15f7176d2b76fe5b13f7ae150
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7761131
Commit-Queue: Andreas Haas <[email protected]>
Reviewed-by: Anton Bikineev <[email protected]>
Cr-Commit-Position: refs/heads/main@{#106530}
---

diff --git a/src/objects/objects-body-descriptors-inl.h b/src/objects/objects-body-descriptors-inl.h
index 9d5d3bd..ba8a917 100644
--- a/src/objects/objects-body-descriptors-inl.h
+++ b/src/objects/objects-body-descriptors-inl.h
@@ -1077,11 +1077,15 @@
   }
 };
 
-class WasmMemoryMapDescriptor::BodyDescriptor : public BodyDescriptorBase {
+class WasmMemoryMapDescriptor::BodyDescriptor final : public BodyDescriptorBase {
  public:
+  template <typename ObjectVisitor>
   static inline void IterateBody(Tagged<Map> map, Tagged<HeapObject> obj,
                                  int object_size, ObjectVisitor* v) {
+    IteratePointers(obj, JSObject::BodyDescriptor::kStartOffset, kMemoryOffset,
+                    v);
     IterateMaybeWeakPointer(obj, kMemoryOffset, v);
+    IterateJSObjectBodyImpl(map, obj, kHeaderSize, object_size, v);
   }
 
   static inline int SizeOf(Tagged<Map> map, Tagged<HeapObject> object) {