Problem: Loading WebAssembly modules that use “return” mid-function can
corrupt the heap and crash the browser.
Cause: HANDLE_INSTRUCTION(return_) shrank the label stack but left any
working values pushed before the “return” instruction on the shared
value stack. Those residuals leaked into the caller’s frame and
accumulated across calls — until they overflowed the value stack’s
inline storage and corrupted adjacent allocator metadata.
Fix: After shrinking the label stack down to the function-level label,
also remove value-stack entries between that label’s recorded
stack_height and the top .arity() result values — mirroring the cleanup
that branch_to_label<true> already performs for br/br_if.
Fixes https://github.com/LadybirdBrowser/ladybird/issues/9614
TryTableArgs only needs catches for try_table instructions. Reuse the
structured-instruction layout with catch storage in place of the else
target, and keep the catch elements in a FixedArray.
This avoids storing a full Vector inline in every Instruction variant
alternative and keeps the catch storage copyable for the variant.
Keep synthetic instruction pointers stable by storing them in fixed
chunks instead of one large Vector. This removes the old oversized
reserve. Expressions without synthetic instructions now avoid extra
instruction storage entirely.
Validation always fills structured instruction metadata before compiled
expressions are executed. Store the metadata directly instead of using
Optional, and update execution and printing paths accordingly.
Wasm opcodes only need one byte plus a 24-bit selector for
prefixed instructions. Store them in u32 instead of u64 and reject
selectors that would not fit. Update the Rust opcode generator to
accept the new integer suffixes used by Opcode.h.
These are part of the typed function references proposal, which is now
widely used by toolchains like wasm-bindgen. This makes sites like
wordsalad.online load in Ladybird.
In preperation for Ubuntu 26.04 LTS, which will most likely come default
with GNU GCC 15.2.0 (but should have versions 14 and 16 available),
found that musttail/tail-call optimization fails for non-release builds.
Testing done on Ubuntu 25.10 which has GNU GCC 15.2.0 as default,
checking: Release, Debug, All_Debug, Sanitizer, and Distribution.
Fixes: #6745
This patch adds support for parsing structs in the type section.
It also removes the assumption that all types in the type section are
function types, adding appropriate validation.
Spec tests struct.3 and struct.4 have been disable as this would
require expanding `ValueType` to include more heap-types.
The label stack should be shrunk to the frame's label_index (exclusive),
not label_index + 1. Also add the missing shrink call for
return_call_indirect.
Instead of trying to indirectly load 2x64 bits from *cc, load addresses
directly from their own contiguous allocation.
This allows a future optimisation where we defer loading addresses to
reduce memory port pressure.
As JS::Value is marked "trivial" without actually being trivial, make
the one user that would lead to garbage JS::Value entries provide a
default value instead.
Previously we were reading the arguments in an incorrect order, and
placing the result in the wrong slot.
This also removes the hacky implementation of accumulative relaxed dot,
and just implements it directly as a new operator.
This is supported starting GCC 15.
The warning -Wmaybe-musttail-local-addr complained about &value possibly
escaping (it cannot, but gcc is being pessimistic about
store_to_memory), so a little rearrangement of that function was
necessary.
Instead of doing a naive O(n^2) liveness detection loop, use a bitmap
for values allocated to registers.
This cuts down validating time from 20% to 1.4% of runtime on the same
game as last commit.
This, along with moving the sources and destination out of the config
object, makes it so we don't have to double-deref to get to them on each
instruction, leading to a ~15% perf improvement on dispatch.
