59eb221d7c
Problem: Loading WebAssembly modules that use “return” mid-function can corrupt the heap and crash the browser. Cause: HANDLE_INSTRUCTION(return_) shrank the label stack but left any working values pushed before the “return” instruction on the shared value stack. Those residuals leaked into the caller’s frame and accumulated across calls — until they overflowed the value stack’s inline storage and corrupted adjacent allocator metadata. Fix: After shrinking the label stack down to the function-level label, also remove value-stack entries between that label’s recorded stack_height and the top .arity() result values — mirroring the cleanup that branch_to_label<true> already performs for br/br_if. Fixes https://github.com/LadybirdBrowser/ladybird/issues/9614 |
||
|---|---|---|
| .. | ||
| test-const-local-local-fusion.js | ||
| test-memfill-memidx.js | ||
| test-memory_fill-order.js | ||
| test-return-mid-function.js | ||
| test-zero-local-cross-module-memory.js | ||