59eb221d7c
Problem: Loading WebAssembly modules that use “return” mid-function can corrupt the heap and crash the browser. Cause: HANDLE_INSTRUCTION(return_) shrank the label stack but left any working values pushed before the “return” instruction on the shared value stack. Those residuals leaked into the caller’s frame and accumulated across calls — until they overflowed the value stack’s inline storage and corrupted adjacent allocator metadata. Fix: After shrinking the label stack down to the function-level label, also remove value-stack entries between that label’s recorded stack_height and the top .arity() result values — mirroring the cleanup that branch_to_label<true> already performs for br/br_if. Fixes https://github.com/LadybirdBrowser/ladybird/issues/9614 |
||
|---|---|---|
| .. | ||
| AbstractMachine.cpp | ||
| AbstractMachine.h | ||
| BytecodeInterpreter.cpp | ||
| BytecodeInterpreter.h | ||
| Configuration.cpp | ||
| Configuration.h | ||
| Interpreter.h | ||
| Operators.h | ||
| Validator.cpp | ||
| Validator.h | ||