59eb221d7c
Problem: Loading WebAssembly modules that use “return” mid-function can corrupt the heap and crash the browser. Cause: HANDLE_INSTRUCTION(return_) shrank the label stack but left any working values pushed before the “return” instruction on the shared value stack. Those residuals leaked into the caller’s frame and accumulated across calls — until they overflowed the value stack’s inline storage and corrupted adjacent allocator metadata. Fix: After shrinking the label stack down to the function-level label, also remove value-stack entries between that label’s recorded stack_height and the top .arity() result values — mirroring the cleanup that branch_to_label<true> already performs for br/br_if. Fixes https://github.com/LadybirdBrowser/ladybird/issues/9614 |
||
|---|---|---|
| .. | ||
| const-local-local-fusion.wasm | ||
| const-local-local-fusion.wat | ||
| empty-module.wasm | ||
| memfill-memidx.wasm | ||
| memory_fill-order.wasm | ||
| return-mid-function.wasm | ||
| return-mid-function.wat | ||
| zero-local-cross-module-memory-callee.wasm | ||
| zero-local-cross-module-memory-callee.wat | ||
| zero-local-cross-module-memory-caller.wasm | ||
| zero-local-cross-module-memory-caller.wat | ||