The following test should trigger a crash where we try to check value profiles and get an invalid cell: (function Polyphic2Import() { let counterA = 0; let counterB = undefined; const counterASetter = v => { print("====A==="); counterA = v }; const counterBSetter = (v, bogus) => { print("====B==="); counterB = { valueB: v } }; const module = wasmModuleWhichImportJS(); const instanceA = new WebAssembly.Instance(module, { imp: { func: counterASetter } }); const instanceB = new WebAssembly.Instance(module, { imp: { func: counterBSetter } }); for (let i = 0; i < 4096; ++i) { print(`Iteration ${i} A:`); instanceA.exports.changeCounter(i); assert.isA(counterA, "number"); assert.eq(counterA, i + 42); print(`Iteration ${i} B:`); instanceB.exports.changeCounter(i); assert.isA(counterB, "object"); assert.eq(counterB.valueB, i + 42); } })(); Removing the `bogus` arg makes the bug go away.
<rdar://problem/29760296>
I think this was fixed by https://bugs.webkit.org/show_bug.cgi?id=171707. I'm going to close this.
*** This bug has been marked as a duplicate of bug 171707 ***