@@ -311,6 +311,23 @@ for (const [offset, size] of [[1, -1], [-1, 1], [-1, -1], [0, 9], [8, 1], [9, 0]
     }
 }
 
+{
+    for (const length of [0, 1, 9, 32]) {
+        const m = instantiate(`
+            (module
+               (type $arr (array (mut anyref)))
+               (global $a (ref $arr) (array.new_default $arr (i32.const ${length})))
+               (func (export "len") (result i32)
+                 (array.len (global.get $a)))
+               (func (export "isNull") (param i32) (result i32)
+                 (ref.is_null (array.get $arr (global.get $a) (local.get 0)))))
+        `).exports;
+        assert.eq(m.len(), length);
+        for (let i = 0; i < length; ++i)
+            assert.eq(m.isNull(i), 1);
+    }
+}
+
 {
     for (const length of [1, 9, 32]) {
         const m = instantiate(`
 
@@ -1799,10 +1799,7 @@ JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationWasmArrayFill16B, void, (void* payloa
 
 JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationWasmArrayFillRefs, void, (uint64_t* payload, uint64_t value, size_t elementCount))
 {
-    // A reference is stored whole so the concurrent collector cannot observe a torn JSValue.
-    volatile uint64_t* cursor = payload;
-    for (size_t i = 0; i < elementCount; ++i)
-        cursor[i] = value;
+    gcSafeMemfill(payload, value, elementCount * sizeof(uint64_t));
 }
 
 JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationWasmArrayCopyRefs, void, (uint64_t* dst, const uint64_t* src, size_t byteCount))
Original file line number	Diff line number	Diff line change
`@@ -1799,10 +1799,7 @@ JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationWasmArrayFill16B, void, (void* payloa`
`1799`	`1799`
`1800`	`1800`	`JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationWasmArrayFillRefs, void, (uint64_t* payload, uint64_t value, size_t elementCount))`
`1801`	`1801`	`{`
`1802`		`- // A reference is stored whole so the concurrent collector cannot observe a torn JSValue.`
`1803`		`- volatile uint64_t* cursor = payload;`
`1804`		`- for (size_t i = 0; i < elementCount; ++i)`
`1805`		`- cursor[i] = value;`
	`1802`	`+ gcSafeMemfill(payload, value, elementCount * sizeof(uint64_t));`
`1806`	`1803`	`}`
`1807`	`1804`
`1808`	`1805`	`JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationWasmArrayCopyRefs, void, (uint64_t* dst, const uint64_t* src, size_t byteCount))`