bug2059109.js - mozsearch

Enable keyboard shortcuts

// |jit-test| skip-if: !wasmCompileMode().includes("baseline")

//

// The Debugger below forces baseline compilation, so this only runs where the

// baseline compiler is available.

//

// Baseline emitTryTable emitted the try_table landing pad without popping the

// try's ref-typed block params, so the pad's stackmaps marked the (dead) param

// spill slot as a live AnyRef. After the param is dropped and collected, that

// slot dangles; a minor GC during exception unwind (here from a Debugger

// onExceptionUnwind hook) then traces the dangling word (use-after-free).

var g = newGlobal({newCompartment: true});

var dbg = new Debugger(g);

dbg.onExceptionUnwind = function(frame, value) {

  var junk = [];

  for (var i = 0; i < 100; i++) junk.push({});  // reuse the freed nursery slot

  minorgc();

};

g.eval(`

  var ins = new WebAssembly.Instance(new WebAssembly.Module(wasmTextToBinary(\`(module

    (tag $a)

    (tag $b)

    (func $thrower throw $b)

    (func (export "test") (param externref) (result i32)

      block $out (result i32)

        block $h

          local.get 0

          try_table (param externref) (result i32) (catch $a $h)

            drop            ;; param is dead; its spill slot is stale from here

            call $thrower   ;; throws $b, not caught by (catch $a)

            i32.const 1

end

          br $out

end

        i32.const 2

      end))\`)));

  for (var i = 0; i < 5; i++) {

    try { ins.exports.test({}); } catch (e) {}

`);