Reduced test case: ``` var wasm_code = wasmTextToBinary(`(module (table 3 3 funcref) (func (export "main") call $f unreachable ) (func $f i32.const 1 return_call_indirect ) )`); var wasm_module = new WebAssembly.Module(wasm_code); var wasm_instance = new WebAssembly.Instance(wasm_module); var f = wasm_instance.exports.main; f() ``` I can reproduce on x64 but not on Aarch64
Bug 1862473 Comment 2 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
deleted
Reduced test case: ``` (module (type $type4 (func)) (func (export "main") i32.const 1 ref.null array ref.null array i32.const -2 i32.const -3 i32.const -4 i32.const -5 call $func2 ref.null $type4 call_ref $type4 unreachable ) (func $func1) (func $func2 (param i32 arrayref arrayref i32 i32 i32 i32) return_call $func1 ) ) ```
Reduced test case: ``` (module var wasm_code = wasmTextToBinary(`(module (func $func1) (func $func2 (param i32 arrayref arrayref i32 i32 i32 i32) return_call $func1 ) (func (export "main") i32.const 1 ref.null array ref.null array i32.const -2 i32.const -3 i32.const -4 i32.const -5 call $func2 ref.null array ref.cast (ref array) drop ) )`); var wasm_module = new WebAssembly.Module(wasm_code); var wasm_instance = new WebAssembly.Instance(wasm_module); var f = wasm_instance.exports.main; f() ```