165639 2016-12-08 17:22:18 -0800 webassembly -> JS calls: arity fixup seems to bork value profile 2017-05-12 15:54:48 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 171707 InRadar P2 Normal --- 165591 161709 1 jfbastien jfbastien ggaren jfbastien keith_miller saam webkit-bug-importer oldest_to_newest 1257971 0 jfbastien 2016-12-08 17:22:18 -0800 The following test should trigger a crash where we try to check value profiles and get an invalid cell: (function Polyphic2Import() { let counterA = 0; let counterB = undefined; const counterASetter = v => { print("====A==="); counterA = v }; const counterBSetter = (v, bogus) => { print("====B==="); counterB = { valueB: v } }; const module = wasmModuleWhichImportJS(); const instanceA = new WebAssembly.Instance(module, { imp: { func: counterASetter } }); const instanceB = new WebAssembly.Instance(module, { imp: { func: counterBSetter } }); for (let i = 0; i < 4096; ++i) { print(`Iteration ${i} A:`); instanceA.exports.changeCounter(i); assert.isA(counterA, "number"); assert.eq(counterA, i + 42); print(`Iteration ${i} B:`); instanceB.exports.changeCounter(i); assert.isA(counterB, "object"); assert.eq(counterB.valueB, i + 42); } })(); Removing the `bogus` arg makes the bug go away. 1261763 1 webkit-bug-importer 2016-12-20 14:27:47 -0800 <rdar://problem/29760296> 1308123 2 keith_miller 2017-05-12 15:54:33 -0700 I think this was fixed by https://bugs.webkit.org/show_bug.cgi?id=171707. I'm going to close this. 1308124 3 keith_miller 2017-05-12 15:54:48 -0700 *** This bug has been marked as a duplicate of bug 171707 ***