TCI's tcg_out_call stores "func" and "cif" as tcg_target_ulong in the TB
using the pool feature. On non-wasm hosts, tcg_target_ulong matches the
pointer size so this commit preserves the original behaviour. On the wasm
host, tcg_target_ulong differs from the pointer size so this change ensures
TCI retrieves the data using the correct type consistent with how it was
stored using the pool feature.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
---
 tcg/tci.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index 700e672616..cee65bceea 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -367,10 +367,12 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 ffi_cif *cif;
                 void *func;
                 unsigned i, s, n;
+                tcg_target_ulong *data;
 
                 tci_args_nl(insn, tb_ptr, &len, &ptr);
-                func = ((void **)ptr)[0];
-                cif = ((void **)ptr)[1];
+                data = ptr;
+                func = (void *)data[0];
+                cif = (void *)data[1];
 
                 n = cif->nargs;
                 for (i = s = 0; i < n; ++i) {
-- 
2.43.0