Released September 15, 2025

CVE-2025-43343

CVSS 9.8 severity critical CWE-119 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Overview

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: an anonymous researcher

Key insight. OMG loop OSR-entry didn’t match the IPInt tier’s scratch-buffer layout for exception slots, so values were read from the wrong indices and the rematerialized value stack was corrupted; positioning exception loads per the IPInt control stack fixes it.

Patch Details

diff --git a/JSTests/wasm/stress/omg-osr-stack-slot-positioning.js b/JSTests/wasm/stress/omg-osr-stack-slot-positioning.js
new file mode 100644
index 000000000000..c960b45e77de
--- /dev/null
+++ b/JSTests/wasm/stress/omg-osr-stack-slot-positioning.js
@@ -0,0 +1,118 @@
+//@ skip if !$isWasmPlatform or $buildType == "debug"
+
+function instantiate(moduleBase64, importObject) {
+    let bytes = Uint8Array.fromBase64(moduleBase64);
+    return WebAssembly.instantiate(bytes, importObject);
+  }
+  const report = $.agent.report;
+  const isJIT = callerIsBBQOrOMGCompiled;
+const extra = {isJIT};
+(async function () {
+let memory0 = new WebAssembly.Memory({initial: 2657, shared: true, maximum: 5930});
+/**
+@param {I64} a0
+@param {FuncRef} a1
+@param {FuncRef} a2
+@returns {[I64, FuncRef, FuncRef]}
+ */
+let fn0 = function (a0, a1, a2) {
+a0?.toString(); a1?.toString(); a2?.toString();
+return [230n, a1, a2];
+};
+/**
+@returns {void}
+ */
+let fn1 = function () {
+};
+/**
+@returns {void}
+ */
+let fn2 = function () {
+};
+/**
+@param {I64} a0
+@param {FuncRef} a1
+@param {FuncRef} a2
+@returns {[I64, FuncRef, FuncRef]}
+ */
+let fn3 = function (a0, a1, a2) {
+a0?.toString(); a1?.toString(); a2?.toString();
+return [1376n, a1, a1];
+};
+/**
+@param {I64} a0
+@param {FuncRef} a1
+@param {FuncRef} a2
+@returns {void}
+ */
+let fn4 = function (a0, a1, a2) {
+a0?.toString(); a1?.toString(); a2?.toString();
+};
+let tag2 = new WebAssembly.Tag({parameters: ['i64', 'anyfunc', 'anyfunc']});
+let tag4 = new WebAssembly.Tag({parameters: []});
+let global0 = new WebAssembly.Global({value: 'i64', mutable: true}, 2544446354n);
+let table0 = new WebAssembly.Table({initial: 90, element: 'externref'});
+let table2 = new WebAssembly.Table({initial: 80, element: 'anyfunc', maximum: 80});
+let table4 = new WebAssembly.Table({initial: 21, element: 'externref', maximum: 557});
+let table6 = new WebAssembly.Table({initial: 12, element: 'externref', maximum: 541});
+let m1 = {fn0, fn1, memory0, table5: table2, table6, table7: table4, table8: table4, tag3: tag2, tag5: tag2};
+let m0 = {fn2, fn4, table4, tag2};
+let m2 = {fn3, global0, table0, table1: table0, table2, table3: table0, tag4};
+let importObject0 = /** @type {Imports2} */ ({extra, m0, m1, m2});
+let i0 = await instantiate('AGFzbQEAAAABLwpgAAF/YAABcGAAAGAAAGAAAn5wYAAAYAAAYAN+cHAAYAN+cHADfnBwYAN+cHAAApACFQJtMQdtZW1vcnkwAgPhFKouAm0xA2ZuMAAIAm0xA2ZuMQACAm0wA2ZuMgAGAm0yA2ZuMwAIAm0wA2ZuNAAHBWV4dHJhBWlzSklUAAACbTAEdGFnMgQACQJtMQR0YWczBAAJAm0yBHRhZzQEAAICbTEEdGFnNQQACQJtMgdnbG9iYWwwA34BAm0yBnRhYmxlMAFvAFoCbTIGdGFibGUxAW8AHAJtMgZ0YWJsZTIBcAFQUAJtMgZ0YWJsZTMBbwAeAm0wBnRhYmxlNAFvARWtBAJtMQZ0YWJsZTUBcAE1+AMCbTEGdGFibGU2AW8BDJ0EAm0xBnRhYmxlNwFvAQGdBgJtMQZ0YWJsZTgBbwEOqQYDBAMABAkEHwhvAFRvACdvAQfDBW8BVogDcABGbwBJcAFdoQNvAE0NCQQABwACAAkABwZeDnwBRNDElsQj4bn5C28B0G8LfQFDAbNWrQt/AUEDC3AB0gcLcAHSBAt/AUECC30BQ5odw5MLfAFE2R6H/Xip+EsLcAHSBAt/AUE/C28B0G8LcAHSAwt/AUGegKIDCwf7ARoIZ2xvYmFsMTADCghnbG9iYWwxMwMNB2dsb2JhbDgDCAhnbG9iYWwxNAMOA2ZuNQAGCGdsb2JhbDExAwsHZ2xvYmFsNQMFCGdsb2JhbDEyAwwHZ2xvYmFsOQMJB2dsb2JhbDIDAgdnbG9iYWw0AwQHdGFibGUxMwEOB2dsb2JhbDMDAwR0YWcwBAAHdGFibGUxMgENB3RhYmxlMTEBDAR0YWcxBAMHZ2xvYmFsNgMGA2ZuNgAHB3RhYmxlMTABCwdnbG9iYWwxAwEHbWVtb3J5MQIAB2dsb2JhbDcDBwd0YWJsZTE1ARAGdGFibGU5AQoHdGFibGUxNAEPCcYGCgVwTdIFC9IFC9IBC9IFC9IHC9IGC9IBC9IGC9IEC9IIC9IEC9IIC9IDC9IHC9ICC9IDC9IAC9IAC9IHC9IIC9IFC9IDC9ICC9IBC9IAC9ICC9IEC9ICC9IHC9IHC9ICC9IDC9IHC9IDC9IGC9IHC9IAC9IFC9IFC9IHC9IHC9IBC9IEC9IIC9IEC9IIC9IHC9IIC9IDC9IHC9IHC9IAC9IBC9IAC9IHC9IHC9IBC9IDC9IBC9IHC9IIC9IHC9IDC9IAC9IHC9IIC9IAC9IGC9IIC9ICC9IEC9IIC9IBC9IEC9IFC9IBC9IHCwdwKdIEC9IGC9IBC9IBC9ICC9IHC9IAC9IAC9IAC9IGC9IGC9IAC9ICC9IEC9IIC9IBC9IFC9IIC9IAC9IFC9IHC9IHC9IBC9IHC9IDC9IHC9IFC9IDC9IHC9IGC9ICC9IDC9IBC9IFC9IAC9IHC9IGC9IFC9IDC9IIC9IDCwMAFgQAAwQFBgMBBQQDAQYEBgYFCAUBAwcDAF4DBQUGAwMIBwAAAwIGAgUAAwIDBAEGAgUGBwIFAQACAgcDBQEHAwADBQIABAgEBgIEBQcBAgEBAwgHAgICAwUFBAQAAQIBCAQEBQcEBAIFCAgHAgcDAwUHAwEDBwcGBXBj0gEL0gQL0gML0gcL0gAL0ggL0gQL0gQL0gQL0gUL0gEL0gML0gAL0gQL0gML0ggL0gYL0gUL0gML0gUL0gAL0gYL0gML0gIL0gcL0gEL0gUL0gEL0gML0gIL0gEL0gcL0ggL0gcL0gcL0ggL0gML0gEL0gAL0gcL0gYL0gML0gIL0ggL0ggL0gcL0gML0gAL0gML0gAL0gcL0ggL0gcL0gcL0ggL0gcL0gUL0gQL0gAL0ggL0gYL0ggL0gYL0gAL0gUL0gQL0gEL0gYL0gIL0gEL0gEL0gAL0gAL0gIL0gIL0gYL0gUL0gcL0gML0gQL0ggL0gEL0gEL0gUL0gIL0gAL0gcL0ggL0gIL0gYL0gQL0gYL0gQL0gUL0gEL0gcL0gML0gcL0gYLAgVBGAsAAgADBgVBHgtwAtIBC9ICCwYCQQALcALSBAvSCAsCBUEZCwACBQYGD0HaAAtwAdIHCwwBBQrLTgP/EgYCfgB8A38BfgF9AXwgALokCSAAeiMKIw0QCD8A/BAFcCUF/AkDBn5CrQEkAAZ8QRkRAAUkB0E1JAsDABAH/BAFQQJwBAIGfxAFRQRADAMLIwlCrAECQAYEBgUgAAZ9A34gAkEBaiICQQJJBEAMAQsQByAABm8QAQwHC0TBXKCRobBK2SAADAkACwwIC/wBDwsMAQtC3Kqq1c6w1fZ10gIgAQwFC9IIBnwMAgELDAMLGkEADgEAAAsCQAIFIwcOAgEAAQsGASABQdK8DUEBcA4BBAQBGRABIwkMAwskBgtCANIHBn/SAERnJMmm6K4ZT0KW2yTDJADSByMHA3wgAQwEAAtE0mYbYcjjxKkMAgsMAwALPwAPCyAAPwANAMQiAAwACyQAQeOlA0MRqidBA3wgAUQc7Cz7udVQztIF0gNDSbyhHIsgASMLDAEAC5sCfQYDBkAYAAwACwJ9AwECAwwAAAtCEyQAQfUADwALAAsAC9IAIAEjAtIBQuIABnwDAQYGGAIQAgJA/BAADgEAAAsjAUPbptWlIAH8EBAMAgALRM1sJew2PYROPwANAAwACyAAQtCh6IPJ1AAhAUO2ASRF/AUGfdIA0ggjAwZwPwD8EA0NAkECcAQAIADDQidDXlObMvwEBkAGfwwBC0EBcA4BAAALUCQEAkAMAAALBm8CAUNfwKKjDAQAC9IEIw4kC/wQEEECcAQEIwtB8/GnMk1B4zgMBQAFIwUMAwALQSRBLkEo/AwEAtIC/BAKDAQL/BABPwCsIAEgACIAJAAhACEBQf//A3EgASAA/kwAACIB0gLSByML/BAOQQJwBH7SByAAAn4Cf0EeEQYFQQtBOEER/AwABQIDAnAgAAwEAAsACwALAAsABSAADAAACz8AJA4CfQYGAwJBHhEDBQJvIwH8B8IkAENKCebOIABCm7bnRCQAJAAMBgALAAtEZVwlYh4by38jALn8BwJ/EAEGBgwCCwwBAAsCfAwBAAufvSIAvyQBDwtBGhEABUQnnyKWssFCPCQBJAtDMZR05QwAAAsMAgAFEAJDRCaYJfwQAQwDAAv8EA1BAXAOAQICAAv8EBD8EAUPCyABIwkkAbUkCPwBIwL8EAdBAnAEfiAA/BAJJA4kAAMAIwZD/cqMTSMNBnAQB0SW5pcGxyYqhgJwAwECAiAHRAAAAAAAAPA/oCIHRAAAAAAAADJAYwRADAULDAAACyABDAQACwAL/BAHDwskBj8ADAIACwwBBQIDDAAAC9IEQuPOvLzlyp/8ZgZ+IAAkAEEfEQYFBgQgAQwCCyQGDAALIgAMAAsiACQAIwRBAnAEAz8AQu0BPwBBAXAOAQAAC9ICQ8OesDI/AEECcAR+BgMCAgYAIAAgAQwDCw0A0gEGfQwCC5FBhwz8EAJBAXAOAAML0gEgASAADAELBgP8EAf8EAFBAnAEBQUGfETz/6jRp5RBmSMFQ66d09dBkBdBI0EQQSX8DAAPDQL8EA4GfAZwRP+o4yIXE2bwQdfhqbwDDQMGfwwEC0ECcARwDAQABQZwAgUMBgALQwMcqFokCAYFGSMD0gZBvs29B/wQAUEDcA4KAAYHBwYABgAHBgYL/BAPQQJwBH8GBBABDAgLDAIABUI/DAgAC0ECcA4CBQYFCwJ8DAUAC0RcFdRIfIDMxZ1mDAcLBkAMBAvSBgN/BgYGBQMBAwRDFKtF8CQIBgZEM3kGTHKhkuHSB/wQCA0AQjEMCwsCQAwJAAsACwALQn9C1LDk756AwrwziCABPwBBAXAOAQgICwwFCyAGQwAAgD+SIgZDAAAQQl0NAAYDBgAjAQwEC0H7AEEDcA4DBgUAAAsMBQALQQJwDgcDBAQDAwMEAwsgAUKs18+d36B0Bm8jDgwGBwMjDUQj87ETSmDI7QwBAAsjAkPkHLN/JAj8EAIPCwwACyMODwsPCxACBgACfBACQR4RAgVBHxEDBQYGAkDSAyABA30MAQALAAsGcAwBAAvSBNIAIABC2wEDcBAFRQRADAELBgMMAgvSBiMEDwALBnBCpNndgusCA3AMAgALROrPTR2nftsCDAILJAYGQAwAAQv8EANBAXAOAQAACxABAnwCQPwQCQwDAAsACwwAAAtEj8x5hWOkk8v8Aw8LQQJwBAUFBgEjDPwQBEEBcA4BAQEAAQALQTBBEkEB/AwAAgNwIAVCAXwiBUIaVARADAELRAxLXwFWwMugBn4CBSAFQgF8IgVCHVQNAhAFRQRADAMLDAMACwIDQusADAEACyAAIAAMAwsjBSABtEH9oQ4GbwIFBn8gAEMAAACAjkO5wpx/AkAMAgALu5lBhpWKxwUMAAsgAAwECwwCAQvSBEHBACQLQvcAukQAAAAAAAAAgPwQDkEBcA4BAQEL0Q8BC9ID0gEgAAZ+Q16Q+TKR/BAADAILDAABAAUGBPwQASQL0gLSBAJ9AnxBIUECcARADAAABdIHIwRBAXAOAQAACyMDDAEACwALIAHCDAEHBAYHEAgCQAwAAAv8EAREtVX5rIg4+X9BLEEWQQ38DAQNIwwkDAkBCwIAAgVEvhHC/QdiN4sjBiQKJAkGACMEDAALQQFwDgAAAQELIw5BAnAEAkKRAfwQB0EBIwdBAXAOAQAAAQsCfdIA0ggjAiQM/BAGA33SAkNFLN6b0gYgAdICIAG1DAEACwALJAM/AA8AC0QT+335BABiLkEqQRxBB/wMAAUGbwZwBgIMAAsCAgwAAAsCBQwAAAsjASMEBAMGBQcDAgcGB9EMCAELDAIAC0LlAQwFCyAADAQBC5tCJCQAQbjUHwwECyMHDwvSB9IDIABENpI9efcTz7f8EAsPCz8ARC56pS/tgPf/Am8CbwMD/BAPJAsGBgICDAAAC0HeACQOQuPpfkJ5RPU7AM2WJxPLQzzcLlxBMkEEQQz8DAQPIwQPAQsgBkMAAIA/kiIGQwAAAEJdDQADBiMLQsEBuj8ADwALAAsACwAL/BAK0gNDJkX3iiQDIAF6AnxEqfrJ1wUjm+tEiKcQePTVcjMMAAAL/AckAAwACyQABnBBiJcBQyndNei8QQFwDgEBARkCf0LUg/u6qoUBJABByvuiCQJvIwUMAgALAAsPCyQFJAggAANAIAVCAXwiBUIfVA0AIAJBAWoiAkEaSQ0AAgQCBgwAAAsGfUPfZSugDAABAAtB0wBBLUEG/AwAD/wBDwALAAsGf/wQCNIAQRtBBUEk/AwADSMEDAAL/BANDwvpMAQDfwF+AX0BfEGy2ezHAUH//wNxMgD6ASMEBn9BMyQOAgUMAAALQ7BqfR8kA0RjPQHTEQ0tS0PH919jQhkkACMKIwQMAAsjDSQGQQJwBAYMAAAFBgQCBAYBDAMLJAoDcAN8EAJBHhEFBQYEEAEMBQsMBQALAAsACyMBtiQIGAEkCiMKDAEBAAALQdUB/BAPcCUPIwkGfyMHQQJwBHBDHUdDnyQI0gUjCJEGfUMcWnM8/AEjDgwCC9IGQ/Rn1X9BoAFBAnAEb0HOAEECcAR+QZ0CQQJwBAQQAQYFIwQMBQEACxACPwCzBm8GBQJv/BADBH4jCw0CAgIQAQwDAAsABRAB/BANDAgACwwEAAskAgwACyMAIw4MBQtB67756gNBAXAOAQICAAVBHhEGBRAFQR5B0gBBDvwMBAJBAnAEb0Hc0+o//BAFcQwFAAUCAwYFIwYCfgZ/AgXSAUENDAEACwwCC0KUi1AkAAwIAAsjB0ECcAQCDAEABQIAEAUMCQALAAskAAwGCwYGAgIDABACDAEACwALGAcMAAALQQhBxgBBBPwMAAUGAUHtAAwGCwwEAAsMAgALQfMBDAMF/BAFBHAjCgwDAAUjA9IDRBxY8xHYgyOrAkAGBQwBC9IH0gNCy3FBLwwFC5ydJAk/AAwEAAsMAgAL0gbSBiML0gcjAMO60ghDJkQRzEPafK/UIwhBBrdEB8PWTZfpkgmbQdT+A0GJnpG7BUH30AH8CwAGfgYGDAABCxACIwX8EA9BAXAOAQICCyMAhyMMQraai7zIACMCDAAFAgYMAAALEAIGAgwACwIFDAAACyMMQdQB0gEjDgwCAAskDCMNIwPSCEHGveD+AQwBAQVDDPEtBtIIIwj8BAJ9Qg1EAAAAAAAA8P8kASMBJAnSA0KTgMuv9bbLAQZ/AgQCBvwQDAwFAAsACw8LIwH8AkEBcA4BAgIL0gcjDCMEDAEACyMF0gXSAUKDgLjV9AgCbxAFJAsGAAMCQ7eBgXVEn89yc/9ad8dCzgEjASQBJACcJAEkAwIBA28QBUUNACAAQQFqIgBBJkkEQAwDC/wQCAwDAAsACwALIwL8EAsNAQwBC0Sq2odKabjxf/wQCwwBAQtEWmeVGMPsXtUDfQJ9IABBAWoiAEESSQ0BAgUgAkEBaiICQQRJDQIMAAALIwIkDCABQQFqIgFBH0kEQAwCC0ERQc0AQRP8DAQFIARDAACAP5IiBEMAADBBXQ0BIAFBAWoiAUExSQ0BIw4kBCAEQwAAgD+SIgRDAAAAAF0EQAwCCyAFRAAAAAAAAPA/oCIFRAAAAAAAAERAYwRADAILIwD8EAsjBiMBJAEjCUELQSlBG/wMAAXSAUQ9p7zhcOltgwN+IwMMAQALAAu7Q8IFfdb8EAkCbyAAQQFqIgBBG0kNASMMDAAACyQC/BAEcCMCJgRBnMo7QtkBQ69GxaAjBEECcAQDQRoRAAVpQQFwDgEAAAv8BVVuBn4CBAYGEAVFDQMMAAEACwMFIwxDAACAfwZ9Iw4Gb/wQAQwGCz8ADAUAC9ID0gD8EAMCfiADQgF8IgNCElQNAUNuPNd/PwBCncPqkHtQIwsMBQALAAsACwwDCz8A/BABQQFwDgEBAQsCb0Tqcfte6v6Y8gJvAgYMAAALBgAGACMC0gIjBQZ9BgUGBUHR0oaneUECcA4IAAABAAAAAQEBC0EfEQIFDAALBgUCBQwBAAsMAAsjDvwQD3AlDyQNIwgMAAv8BEOOpC2JQiH8EA8MBAskB0ElBn0CfgJ8Q2ywlSfSAtIA0ggjBj8AJAQCfCMMDAUACwALAAvCJAAGBERsf4HRybCi1SQBIwYGQEEfEQYFDAALIwQMBQELJAYkAAYFC0P8m4pnGAMjACQAQTVBxwBBDfwMBA1B9LLwiHgjAL8kCQwACwwCCwwAAAsGcCMCA0AGACMAIwCIQtsBIw4MAwskDvwQCrOM/BAAQRhBxwBBAvwMBA8kB478AQwCAAv8EAskB0KNdNICQ6YfNG0CbyMORQwCAAv8CQL8EAP8EANBAXAOAQEBAAtBy/jW/QAMAAtBAnAEfAYBBgMMAAsGfyMHDAALQ6y2pEsGQAN9BgMjDdIDQ+RYUVgkA0ICJABDCR2LwZECbwYEQ/pLRDIkCAICDAUAC0SMDnUXE2ACQ0LtACMBDAYL/BAODgUGBgYGBgYLJAICQESLcZd3RNogi/4DAAwFAAuLAnAMAwALIwtBAnAOAgIAAgEAAQsMAQALQx1jlvUGb0ToIwuliuzjaNIDPwCzvEEBcA4BAQELQgc/AEEBcA4BAAAL/BAG/BADcCUDIwojASQBDAALJA0GARAC/BANJAf8EBAEAAYD0ggDQCAAQQFqIgBBAUkNACABQQFqIgFBFUkEQAwBCxAFRLgVF7JX60+TBm8DQAJ+QZ/w0gVBLEHBAEEE/AwAAgwFAAsACwYEIwwjAAZ/BgUMAAsDASADQgF8IgNCHVQNBAYDQxQPqAaQQuKR583XQdII0gbSBUEiQcgAQQT8DAAP0gICcAIGAgIQAgIFDAIACwALAAsjByQHEAVFBEAMAwtCKbT8BPwQDgwDAAvSAkO09eCw/BAGDQAkA0PMr9pkIwI/AAR8DAEABQIAIABBAWoiAEESSQ0HIwJBKgwAAAskBCAAQQFqIgBBJkkNBgMAEAVFBEAMAQtBpcjZqAMMBAALAAvSBSMKJAX8EA4NBiMCDAQLIAFBAWoiAUEcSQRADAUL0gDSCEPC9+V9jY8CfURewrHIl8JkCvwQCEEBcA4ICQkJCQkJCQkJC/wQDAwBAAsjBgwGC0EBcA4BAwMLIwg/ACQE/AX8EA4Gf9IIBn8GA0L31qJ/IwcEAAYB0gMjBgwJCyQFDAEABQYCBgUMCAtDkwZTnUObgjwsJAjSBvwQCA0APwBBA3AOAgAHAgtCtuvN1o+d460BJADSCCMA0gNEAAAAAAAAAAAMCQALDAIBAQsjCwwACwwACwwDC0I5An8MAgALAAsjDiMEQQJwBG8GAgYFAm8Gb0HPmQFBA3AOAwUDAgULIwcDfAwFAAsACyMOQQNwDgMAAwEDCwYGIwgjBSMB/BAIDQAMBgsMAhkDAAwBAAtBAnAOCgICAAIAAAICAgAACwJ/DAIACwAFEAEGBgwACwYAAwMjC0ECcARAAgECBQwCAAsACwAFIAFBAWoiAUExSQRADAILEAVFBEAMAgsMAAALEAJEo3KmR0wBewgMBgALDAILDAIACwNvQ93ap1XSAyMIBn0GQAsQBUG124nVfQ4BAwML/BAQDQEGcAwCCyQGiyMOQ7h6wylD7O2O1wJ9AwUgAkEBaiICQSJJBEAMAwsMAwALAAsACyQMQufx15F7wwZ8DAELIwJDO9Vm2wZ+AgUMAgAL0gD8EAUaQQkOAQEBAQsGfQYFA0BETPcz90+ASTkMBgALQt4AxKcMAwsGfQwCC7wMAgv8EAkkByMBIwxB9bkCQQVBAfwIAQAkDAwDAQtC9QBEyESUI4TRg+8CfwZ9Iwn8EATSBAJA/BAKDQDSByMODQDSB0GrAUTcZslDP7RTaAwFC/wQAEECcAQA/BABDAMABSMJ0gTSAQZ/Bn8/AEECcAQAEAJBleq5onoFBgJEFPg6AmUqLGIMCQsGfQIDRArf2dqGysMxJAkMAAAL0gEjBAwGAQsGfUEiQRlBDfwMAAIGBgcFAgRBuvccDAUACwwJAAsjBtIHQ4Q/8r0MAAskA0Hn0Z/XAwwDAAvSByMHDAUAC/wQCgwACwwACyMF0UECcA4CAQIBCz8AIwtBAnAEBQwAAAUjCwwCAAs/ANIFQ2LdNh9Bqd6wDgwBCwwABQJ/RMGHAsOGF/H/QvuGrfHl3dM9wqdBAnAEQAJwDAEACwAFDAAACyQBRK8ATulIOIX8A34GAAZABwIQBUUNAvwQDQ0A0gADcBAF/BAHPwAMBQALBnAMAQsjDvwQAwwDAAsGACMBDAYLQbQBDQMEfxAFRQ0CAgBBqvvGDwwBAAsABSMA0gAjCPwFIw4MAAALrNID/gMAQ29AW64kAyMIQmf8EAX8EAgMAwsMAQAL/BALDAELJAsCAUKnr9K0CnmnDAEACz8ADAALIwkjCCQDAnAjBfwQDkECcA4CAAEBCyMB/AIkCwJ90gcjACQAAn0jByMDIwRBAnAOAQABCwJ+IwQkCz8AAnBDWFO3vfwQCgQE0gHSBdIGQcEAQRdBA/wMBAICcCMKDAUACwAFBgMMAAsjAwwDAAskCiMG0gDSAiMFDAMACwAL0gL8EAoGQAwAAAsjAEQhEp2L4+5gxiMHDgECAgskAz8AQQFwDgEAAAskBdIDRMLnx8JPILMVDAAFQR8RAwUjBEECcARADAAABQJ9QeoMQQFwDgEBAQsjBtIBIwkGfgwBCyMODgEAAAsGbwNwAgEGBQMABgYYAUOQ9rd/Iwb8EA0jDkEBcA4BAQELDQAgA0IBfCIDQgVUDQIQBSMHQQFwDgEAAAtBwoHjpXg/AEECcAR+QR4RAgUGAwwAC0Gg7QNBEQZ/AwAQASMIQe8cQQJwBEDSBfwQAgwCAAUGBdIF0gHSAyMADAQBCwYCDAALDAAACwZ9QYMBQQJwBAMgBEMAAIA/kiIEQwAANEJdDQYgAEEBaiIAQQlJBEAMBwsgAUEBaiIBQSdJDQIQBUUEQAwHCwZ/AgQgA0IBfCIDQi9UBEAMCQsQBQJADAAACwwFAAsMBgu+JAgGfBAFRQ0DBgYYCgZ/IAFBAWoiAUEFSQ0I0gX8EA0MAAtBAnAEAUSxqBI9Mdmg1wZvEAVFDQkGBhlE2S+Tpr3OQSdCpgGnQQJwDgIABAQBCyADQgF8IgNCFFQNBRAC/BANQQFwDgQDAwMDAwv8EBANCQwJAAUgAUEBaiIBQRBJDQQMAgAL/BAHQQFwDgEBAQtCoQH8EAtBAXAOAQAAAAALAgUGBQwACxAFQQFwDgEAAAtBHxEDBSACQQFqIgJBEEkNBQYAAgMMAAALIwYMBQtBAnAEcAYDBgILAwAQBUUNACAFRAAAAAAAAPA/oCIFRAAAAAAAADJAYwRADAULIwQMBQALDQAGBAwBCwJvRKPg/+eJQLRQDAoACyMFAn4CBiMMIwsNCgwKAAsACyMGDAELIABBAWoiAEEbSQRADAcLAgYgBUQAAAAAAADwP6AiBUQAAAAAAAAcQGMNAxAFRQRADAgLQquB65e6fiQAIwcEbyACQQFqIgJBCUkNBCABQQFqIgFBEUkNCCAFRAAAAAAAAPA/oCIFRAAAAAAAAAAAYwRADAkLQR4RAwUgBUQAAAAAAADwP6AiBUQAAAAAAAA3QGMNCCAAQQFqIgBBAkkEQAwFCyACQQFqIgJBEkkEQAwFCyAEQwAAgD+SIgRDAAA8Ql0EQAwFCyABQQFqIgFBAUkNCCAAQQFqIgBBLEkEQAwFCyMFDAIABSMMDAkACwJvBm8gAUEBaiIBQQ5JBEAMBgsgAEEBaiIAQRZJBEAMBgsgBEMAAIA/kiIEQwAAgEFdDQkCBgMB0gRDAACA/7sMDQALAAsjBQwDC0M986qzDAMACwAL0gQjAgwHAQUgBUQAAAAAAADwP6AiBUQAAAAAAABHQGMEQAwDC0K3y8WZ482Tv30CfiAAQQFqIgBBHkkNAyAAQQFqIgBBIkkEQAwIC/wQAgwEAAsAC0Qr7uc2jK4PIAwHC2AMAQALDAALJA4GQAYDDAEBC0O4BhD7IwRBAnAEfwwBAAUCfgwCAAsAC0ECcARwIAVEAAAAAAAA8D+gIgVEAAAAAACAQUBjDQQCfhAFQQFwDgECAgu6JAkMAQAFDAEACz8AQQFwDgECAgtvJAdC+VQMAAUjAEOb8cmePwBBEkHVAEEJ/AwEAiQL0gcjB7cMBAALJAD8EA9wJQ8MAAsjDCQC0QRvQY/hACQOBgUGBQYBDAELQ+XxepMkCCQFC0EaEQAFQQFwDgEAAAsCBSMF/BAIQQFwDgEAAAsgA0IBfCIDQh1UDQECBSAEQwAAgD+SIgRDAACQQV0NAkNNLoKP/AD8EAUaQQAOAQAACyACQQFqIgJBJEkEQAwCCyAEQwAAgD+SIgRDAABEQl0NAUEBJQgkAgJvQabOBUSmdtfrfnhGgwN+IABBAWoiAEERSQ0ABgMLIARDAACAP5IiBEMAACBCXQ0AIAJBAWoiAkEtSQ0DIwUkBUL2ACQAIAVEAAAAAAAA8D+gIgVEAAAAAAAALkBjDQMgBUQAAAAAAADwP6AiBUQAAAAAAABGQGMNAEQpAxZMcoEduAwFAAsACwAFIAVEAAAAAAAA8D+gIgVEAAAAAAAAQ0BjBEAMAgsgAUEBaiIBQStJDQECAQMG0gUaCyMFBkAgAUEBaiIBQShJBEAMBAsgBEMAAIA/kiIEQwAA4EBdDQP8EAVBAXAOAQAACwwAAAsCQAJABgEMAgAL0UECcA4CAQAACyMEQQFwDgEAAAsCf0LyncfbAUG6ASQLQcsAQR1BDfwMAA96GkGZgOn7AAwAAAskCyQGIAJBAWoiAkEmSQ0BBgBE4gzym8jXXyAMBAskDhAFJAcgAEEBaiIAQSVJDQFCnwFDwLTyehoGfCMJCyQJJAAGfSMAJABBp8KYAyQEBgMgA0IBfCIDQgpUDQNCtAEaAkALAgBEUBWyNJefB5YMBgALQQFwDgEAAAALIABBAWoiAEEBSQ0CAwRBnNUDQaYBQaog/AsAIAJBAWoiAkEvSQRADAELBm8DAwIEIAVEAAAAAAAA8D+gIgVEAAAAAAAA8D9jDQFC5pnWatIFQQkjDiQHQeUAJAskCxpBMyUFDwALAAsjDAwDCwwCAAsPCyQDBnxDGtTp9wZwQTIlDyQFQSklAvwQBA0AGAAaJAg/ABogA0IBfCIDQgNUDQLSCBojDCQCIwkkAUNaAsP/Bm8CfUMR+rh//BAOQQFwDgEAAAuNIwYjCCMGGkHHmQJB2QBBgtUA/AsAJAhB6Z73xgNBAnAEfPwQBSQLAgUCBQsCBQZv/AkEIARDAACAP5IiBEMAAJBBXQ0HDAILDAMACwtENHRM5V4wHV1EsQwfSwOo0f9kQQJwBAFBKCUCQSpBBUEY/AwADQwAAAUDBBABQsoBQQdBB0E//AwAD3oGcEEzJQ8jBEECcA4FAgIAAgIACwskBkNNJTFWJAj8EBBBHUHUAEEM/AwEDSQO/BANPwAaJAcaBgUgBUQAAAAAAADwP6AiBUQAAAAAAIBGQGMEQAwHCwZ9QQoOAAELGkRwV0bUyh1aSyMBDAQAC0E1JQ8L/BADGhojAQwCAAVEj7W4VBXJGc4jDSMDJAMkBQwCAAtChgEjASMO/BALJAtBAnAOAgUBBQAAAQsMAQELtkPjdNT/QfoBJAv8BUHUxAJB+8wBQcbZA/wKAAAkACMBDAMLDAEACyQGEAECBkG/9QlBAXAOAQAAC0T5eiyQdo18qtIHIwgkCCMEQf//A3EyAf8HPwAkDiQAQg4kANIF0ggaPwAkBBrSCBojCCMJnANwIwv8EANB/v8Dcf4TAQBJBG8DASMFC0EEQTpBBPwMAAUkCgYBBgBBBgwAC/wQACQOQQJwBAFCggEkAAYBEAVFBEAMBQsjCgskDSAAQQFqIgBBAUkNAwICC0EKJQUMAAAFQQ0lDQwAAAsLJAogAEEBaiIAQSVJBEAMAgsCAQIDA34gAkEBaiICQQZJBEAMBQsjAgwDAAsACwALAAUQBUUNASAFRAAAAAAAAPA/oCIFRAAAAAAAgEFAYwRADAILIABBAWoiAEEtSQRADAILBkAQBUUNAgJvEAVFBEAMBAsMAQALJAILAm8jAiQCIAVEAAAAAAAA8D+gIgVEAAAAAACAQkBjDQIjAiQMQRkRAAUkBwMBIANCAXwiA0IaVA0AQRYlBQsjAiQCQ+E6OJwDQCACQQFqIgJBHEkNAAskCCMEQQJwBAMQBUUNAwVByQBBBUEB/AwADwYDDAABAAcHJAb8EBBBAXAOAQcHCwwAAAskBUE4JRALDAIACyQC/BALJA4gA0IBfCIDQiFUDQAGASMF0ggGcAYDCwYCCwN8BgEjBgsMAQALDAQACwwACwvSCBokDdIFIw78EBBB2qLv+X1pBnxEzSbuiJ8H8/8LDAELJAxEamaYFgdq/McLIwdBAnAEAAYFDAALQQgMAAAFREbdrlnTLaMiIwkkCb1DZr5I8yQDGiMNIwQMAAALJA5BNUECQQP8DAQCnSQJn/wH/BAFJA4kAPwQB0GcAXgjAgZADAAL/BAAJAckDPwQEHAjDCYQJAX8EAJwIwUmAtIFGiQAIw0kCkL0ALQkA0OGGs+I/AQjBQwAC9wKDAFwAX0BcABwAXABfgJ/An8DfwF+AX0BfEIEIAUgCUECcAQBIwJEmJGEmzWbtE0CfgMBAgRDhxgXbz8ADQQCfQMBIA9CAXwiD0IdVA0AQay16wIEARAFRQRADAILAgAQBUUEQAwGCyMNIwkDf0GAw7LxAkHLAfwQCHAlCAZ/BgD+AwAGfBAFDAILIAsOAQsLCwwACwwBAAsACwJ/Q27O1JX8EApBAXAOAQMDAQtBAnAEbwYEIBFEAAAAAAAA8D+gIhFEAAAAAAAAEEBjBEAMBAsgDEEBaiIMQQlJBEAMBwsCAyANQQFqIg1BHUkNByARRAAAAAAAAPA/oCIRRAAAAAAAAD9AYwRADAgLIA5BAWoiDkEESQRADAULDAAAC0TJbQ/IrEVkoCQJBgIGASAMQQFqIgxBF0kNCCAH/BABIQsMCQsiBiAIQQJwDgIACgAL/BACAm8MCgALDAELIAEMBwVEn1B0/i0lCqzSBQZ8AgUgDEEBaiIMQRtJDQcCAUGekzwOAgELCwsGQCAQQwAAgD+SIhBDAAA4Ql0EQAwJCyABIAYMBAsMCQsQBUUEQAwHCwJ+IAxBAWoiDEEqSQRADAUL0gfSBwJwAwRE/koZmJ7aVwwCfSMKIwL8EAX8EAlwJQkGfwYDAgZC1gAMBgALDAALQR4RAwVEIcW643Za6fcMBQtBAnAEA9IB0gZC/gG6IAsNAAwFAQsgBCMN0gBCAfwQCQ4KAwsDAwMLAwsDCwMLBn8CQAwAAAtBrL2SAkECcARAIw4MAQAF0gQgBQwNAAsQBUUEQAwICxAFRQRADAILDA0LAn8gDkEBaiIOQQtJDQcgEEMAAIA/kiIQQwAAiEFdDQpE8d+tYXrb8j4kCQZ8IAEMAwtEAAAAAAAAAAAMBAALAAsGfA8BAQsMAgsMCQtBMkNEFPlVQQD8EAENCUH//wNxLACJBQ0EDAQAAQsGQBgIJAEGfD8AIAlBCyAAQs2A+6jw498WRPnwTBKrE6F8DAALJAkgACQA/BAMQQFwDgEICAtBzQENB/wQCUEBcA4BBwcABQwHAAsiBgwFAAsjCCEEDAQL0gjSB/wQDkECcAQADwAFDAUACyAFRCcgh/3L0IH2/AMaQQAOAQQECwwCAAsMAQsjBSMEQQFwDgABBSMGQvsBQtfjeCIHQt8Bp9IG0gVBw6bZlwMNASMM0gU/AA0BIwFDS9gus/wQAg0BPwANASQIJAH8EAQNAUEADgEBAQtBH0EyQQf8DAQFAggCCAYHDAIBCw8ACwYHDAEAAQsGBgwCCw8LIgUGCQJ/IwxBnN0CQZbk5sF9QaWZA/wLACMGIQX8EAtBAnAOAgECAgtBAnAOAgABAQELBgIGcEGOI0ECcA4CAQICC0MV8y76IAZEoi39JnDO6BogCEECcA4CAAEBC0LTAUNoINxNIw0jBgJ+RGvBjyYvu/7/JAEMAQALIwQNACEHQsvwvf+tpAYDfQwBAAsCfdIDQRhB//8Dcf4SAABBAXAOAQEBC5T8EAcNANIGRIj9ofYg7ZTsJAlEbRco/q9piPw/AA0A0gcgBCAE0ghCl+e10rWMzn4GQAwACyQA0gIgAEPti7lgJAN7JAAgBP4DACQIQfKUyL0DIgkGb/wQDj8ADQFBAXAOAQEBC9IDQugAIgDCup4kASAE0gAgAUT5VMQ36FP4/0QsuEEPaxAXLaTSBEML3pYCBn0jDCQMRArwgfDpsXm6JAEGfSMKJA0MAgsGfkIbv55CAfwQDkEBcA4BAAALIApBAnAEAQwCAAUPAAtDzP+Ch7xBAXAOAQEBC0H7wq7lfQ0AIwtBAXAOAQAACws4BQEGDqbuLUjIAQg0Vk5W1CsQPABB27MDCwexNdp88N+BAEHRLQsBdQBBqKsDCwncWuNpl/7i/7Y=', importObject0);
+let {fn5, fn6, global1, global2, global3, global4, global5, global6, global7, global8, global9, global10, global11, global12, global13, global14, memory1, table9, table10, table11, table12, table13, table14, table15, tag0, tag1} = /**
+  @type {{
+fn5: () => I32,
+fn6: () => [I64, FuncRef],
+global1: WebAssembly.Global,
+global2: WebAssembly.Global,
+global3: WebAssembly.Global,
+global4: WebAssembly.Global,
+global5: WebAssembly.Global,
+global6: WebAssembly.Global,
+global7: WebAssembly.Global,
+global8: WebAssembly.Global,
+global9: WebAssembly.Global,
+global10: WebAssembly.Global,
+global11: WebAssembly.Global,
+global12: WebAssembly.Global,
+global13: WebAssembly.Global,
+global14: WebAssembly.Global,
+memory1: WebAssembly.Memory,
+table9: WebAssembly.Table,
+table10: WebAssembly.Table,
+table11: WebAssembly.Table,
+table12: WebAssembly.Table,
+table13: WebAssembly.Table,
+table14: WebAssembly.Table,
+table15: WebAssembly.Table,
+tag0: WebAssembly.Tag,
+tag1: WebAssembly.Tag
+  }} */ (i0.instance.exports);
+table0.set(34, table10);
+table11.set(22, table4);
+table0.set(53, table0);
+table10.set(3, table10);
+table4.set(14, table9);
+table15.set(68, table10);
+global2.value = 'a';
+global10.value = null;
+
+try {
+  for (let k=0; k<16; k++) {
+    let zzz = fn6();
+    if (!(zzz instanceof Array)) { throw new Error('expected array but return value is '+zzz); }
+    if (zzz.length != 2) { throw new Error('expected array of length 2 but return value is '+zzz); }
+    let [r0, r1] = zzz;
+    r0?.toString(); r1?.toString();
+  }
+} catch (e) {
+  if (e instanceof WebAssembly.Exception) {
+  } else if (e instanceof TypeError) {
+  if (e.message === 'an exported wasm function cannot contain a v128 parameter or return value') {} else { throw e; }
+  } else if (e instanceof WebAssembly.RuntimeError || e instanceof RangeError) {} else { throw e; }
+}
+
+})().then(() => {
+}).catch(e => {
+})
diff --git a/Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp b/Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
index 1f75b329a384..2e146c2b4901 100644
--- a/Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
+++ b/Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
@@ -4818,7 +4818,7 @@ void OMGIRGenerator::connectValuesAtEntrypoint(unsigned& indexInBuffer, Value* p
         Value* load = loadFromScratchBuffer(indexInBuffer, pointer, value->type());
         m_currentBlock->appendNew<VariableValue>(m_proc, Set, origin(), value.value(), load);
     }
-    if (exceptionVariable) {
+    if (!Options::useWasmIPInt() && exceptionVariable) {
         Value* load = loadFromScratchBuffer(indexInBuffer, pointer, pointerType());
         m_currentBlock->appendNew<VariableValue>(m_proc, Set, origin(), exceptionVariable, load);
     }
@@ -4855,14 +4855,23 @@ auto OMGIRGenerator::addLoop(BlockSignature signature, Stack& enclosingStack, Co
         for (auto& local : m_locals)
             m_currentBlock->appendNew<VariableValue>(m_proc, Set, Origin(), local, loadFromScratchBuffer(indexInBuffer, pointer, local->type()));
 
+        if (Options::useWasmIPInt()) {
+            for (unsigned controlIndex = 0; controlIndex < m_parser->controlStack().size(); ++controlIndex) {
+                auto& data = m_parser->controlStack()[controlIndex].controlData;
+                if (ControlType::isAnyCatch(data)) {
+                    auto* load = loadFromScratchBuffer(indexInBuffer, pointer, pointerType());
+                    m_currentBlock->appendNew<VariableValue>(m_proc, Set, origin(), data.exception(), load);
+                } else if (ControlType::isTry(data))
+                    ++indexInBuffer;
+            }
+        }
+
         for (unsigned controlIndex = 0; controlIndex < m_parser->controlStack().size(); ++controlIndex) {
             auto& data = m_parser->controlStack()[controlIndex].controlData;
             auto& expressionStack = m_parser->controlStack()[controlIndex].enclosedExpressionStack;
             ASSERT(&data != &block);
             Variable* exceptionVariable = ControlType::isAnyCatch(data) ? data.exception() : nullptr;
             connectValuesAtEntrypoint(indexInBuffer, pointer, expressionStack, exceptionVariable);
-            if (ControlType::isTry(data))
-                ++indexInBuffer;
         }
         connectValuesAtEntrypoint(indexInBuffer, pointer, enclosingStack, nullptr);
         // The loop's stack can be read by the loop body, so the restored values should join using the loop-back phi nodes.

Background

Advisory: Apple Security Advisory

Attribute	Value
CVE	CVE-2025-43343
Bugzilla	296490
Component	JSC
Bug Class	TypeConfusion
Severity	medium
Commit	899a38cf9a50a555…
Advisory	Apple Advisory

Terminology

OMG tier / OSR entry — The optimizing wasm JIT; loop OSR entry rebuilds the value stack from an OSR scratch buffer.
OSR scratch buffer — A buffer holding live values at OSR-entry, read back in a fixed index order that must match the source tier’s layout.
IPInt (useWasmIPInt) — The in-place interpreter tier whose stack/exception slot layout differs from the older interpreter’s.
Exception variable / catch frame — An exception value bound in a catch control frame that occupies a scratch-buffer slot at OSR entry.

Root Cause Analysis

JavaScriptCore’s OMG (optimizing) wasm tier rematerializes the value stack at loop OSR entry by reading values from an OSR scratch buffer in a fixed index order (connectValuesAtEntrypoint / addLoop in OMGIRGenerator). Exception-handling control frames contribute an ’exception’ value that occupies a scratch-buffer slot, and the ordering must match how the source tier laid out the buffer. When the in-place interpreter tier (useWasmIPInt) is enabled, the exception values for enclosing try/catch frames are positioned differently, but the pre-patch OMG code did not account for that: it handled the exception variable unconditionally (only advancing indexInBuffer for try frames) rather than following the IPInt layout, so at OSR entry into a loop nested inside catch handlers it read values from the wrong scratch-buffer slots. Consuming a stack slot at the wrong offset (e.g. treating a non-exception slot as the exception, or misaligning all subsequent values) corrupts the rematerialized value stack, crashing (or type-confusing) the OMG-compiled code. The fix, when Options::useWasmIPInt() is set, walks the parser control stack and, for each catch frame, loads the exception from the scratch buffer into the frame’s exception variable (and advances indexInBuffer for try frames), matching the IPInt slot layout; it also guards the old exceptionVariable handling with !useWasmIPInt(). The restored invariant is that OSR-entry stack-slot positioning for exception values matches the active lower tier’s scratch-buffer layout.

Attack Path

1. Craft wasm with loops in catch frames

Build a module (with IPInt enabled) whose function has loops nested inside try/catch handlers, forcing OMG loop OSR entry.

2. Trigger OMG OSR entry

Run the function hot so it OSR-enters the OMG tier at the loop with catch frames on the control stack.

3. Misposition scratch slots

Pre-patch, OMG reads exception/stack values from the wrong scratch-buffer indices for the IPInt layout.

4. Corrupt the value stack

The rematerialized stack is misaligned, crashing or type-confusing the compiled code in the WebContent process.

Impact Assessment

An OSR-entry stack-slot mispositioning in the OMG wasm JIT when IPInt is enabled and loops are nested in catch handlers, reachable from crafted wasm in the WebContent process. Misaligned value-stack rematerialization is a corruption/type-confusion-class bug; the observed effect is a crash. Confined to WebContent; rated medium.

Audit Directions

OSR scratch-buffer index parity

Audit connectValuesAtEntrypoint/addLoop index accounting against both IPInt and legacy interpreter layouts for all control-frame kinds.

Tier-dependent slot layouts

grep for Options::useWasmIPInt() around stack/exception slot positioning to ensure every OSR path branches consistently.

Catch/try frame handling

Review exception-variable rematerialization in OMG/BBQ OSR for correct per-frame slot advancement.

Changed Functions

Function	File	Change	Note
`OMGIRGenerator::addLoop`	`Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp`	modified	When useWasmIPInt(), walks the control stack loading each catch frame’s exception from the scratch buffer (and advancing indexInBuffer for try), matching the IPInt OSR-entry slot layout.
`OMGIRGenerator::connectValuesAtEntrypoint`	`Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp`	modified	Guards the previous unconditional exceptionVariable handling with !useWasmIPInt() so it doesn’t double/mis-position exception slots under IPInt.

Files Changed

Source Files

Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp

Test Files

JSTests/wasm/stress/omg-osr-stack-slot-positioning.js

Regression Test

The fix ships this proof-of-concept / regression test:

diff --git a/JSTests/wasm/stress/omg-osr-stack-slot-positioning.js b/JSTests/wasm/stress/omg-osr-stack-slot-positioning.js
new file mode 100644
index 000000000000..c960b45e77de
--- /dev/null
+++ b/JSTests/wasm/stress/omg-osr-stack-slot-positioning.js
@@ -0,0 +1,118 @@
+//@ skip if !$isWasmPlatform or $buildType == "debug"
+
+function instantiate(moduleBase64, importObject) {
+    let bytes = Uint8Array.fromBase64(moduleBase64);
+    return WebAssembly.instantiate(bytes, importObject);
+  }
+  const report = $.agent.report;
+  const isJIT = callerIsBBQOrOMGCompiled;
+const extra = {isJIT};
+(async function () {
+let memory0 = new WebAssembly.Memory({initial: 2657, shared: true, maximum: 5930});
+/**
+@param {I64} a0
+@param {FuncRef} a1
+@param {FuncRef} a2
+@returns {[I64, FuncRef, FuncRef]}
+ */
+let fn0 = function (a0, a1, a2) {
+a0?.toString(); a1?.toString(); a2?.toString();
+return [230n, a1, a2];
+};
+/**
+@returns {void}
+ */
+let fn1 = function () {
+};
+/**
+@returns {void}
+ */
+let fn2 = function () {
+};
+/**
+@param {I64} a0
+@param {FuncRef} a1
+@param {FuncRef} a2
+@returns {[I64, FuncRef, FuncRef]}
+ */
+let fn3 = function (a0, a1, a2) {
+a0?.toString(); a1?.toString(); a2?.toString();
+return [1376n, a1, a1];
+};
+/**
+@param {I64} a0
+@param {FuncRef} a1
+@param {FuncRef} a2
+@returns {void}
+ */
+let fn4 = function (a0, a1, a2) {
+a0?.toString(); a1?.toString(); a2?.toString();
+};
+let tag2 = new WebAssembly.Tag({parameters: ['i64', 'anyfunc', 'anyfunc']});
+let tag4 = new WebAssembly.Tag({parameters: []});
+let global0 = new WebAssembly.Global({value: 'i64', mutable: true}, 2544446354n);
+let table0 = new WebAssembly.Table({initial: 90, element: 'externref'});
+let table2 = new WebAssembly.Table({initial: 80, element: 'anyfunc', maximum: 80});
+let table4 = new WebAssembly.Table({initial: 21, element: 'externref', maximum: 557});
+let table6 = new WebAssembly.Table({initial: 12, element: 'externref', maximum: 541});
+let m1 = {fn0, fn1, memory0, table5: table2, table6, table7: table4, table8: table4, tag3: tag2, tag5: tag2};
+let m0 = {fn2, fn4, table4, tag2};
+let m2 = {fn3, global0, table0, table1: table0, table2, table3: table0, tag4};
+let importObject0 = /** @type {Imports2} */ ({extra, m0, m1, m2});
+let i0 = await instantiate('AGFzbQEAAAABLwpgAAF/YAABcGAAAGAAAGAAAn5wYAAAYAAAYAN+cHAAYAN+cHADfnBwYAN+cHAAApACFQJtMQdtZW1vcnkwAgPhFKouAm0xA2ZuMAAIAm0xA2ZuMQACAm0wA2ZuMgAGAm0yA2ZuMwAIAm0wA2ZuNAAHBWV4dHJhBWlzSklUAAACbTAEdGFnMgQACQJtMQR0YWczBAAJAm0yBHRhZzQEAAICbTEEdGFnNQQACQJtMgdnbG9iYWwwA34BAm0yBnRhYmxlMAFvAFoCbTIGdGFibGUxAW8AHAJtMgZ0YWJsZTIBcAFQUAJtMgZ0YWJsZTMBbwAeAm0wBnRhYmxlNAFvARWtBAJtMQZ0YWJsZTUBcAE1+AMCbTEGdGFibGU2AW8BDJ0EAm0xBnRhYmxlNwFvAQGdBgJtMQZ0YWJsZTgBbwEOqQYDBAMABAkEHwhvAFRvACdvAQfDBW8BVogDcABGbwBJcAFdoQNvAE0NCQQABwACAAkABwZeDnwBRNDElsQj4bn5C28B0G8LfQFDAbNWrQt/AUEDC3AB0gcLcAHSBAt/AUECC30BQ5odw5MLfAFE2R6H/Xip+EsLcAHSBAt/AUE/C28B0G8LcAHSAwt/AUGegKIDCwf7ARoIZ2xvYmFsMTADCghnbG9iYWwxMwMNB2dsb2JhbDgDCAhnbG9iYWwxNAMOA2ZuNQAGCGdsb2JhbDExAwsHZ2xvYmFsNQMFCGdsb2JhbDEyAwwHZ2xvYmFsOQMJB2dsb2JhbDIDAgdnbG9iYWw0AwQHdGFibGUxMwEOB2dsb2JhbDMDAwR0YWcwBAAHdGFibGUxMgENB3RhYmxlMTEBDAR0YWcxBAMHZ2xvYmFsNgMGA2ZuNgAHB3RhYmxlMTABCwdnbG9iYWwxAwEHbWVtb3J5MQIAB2dsb2JhbDcDBwd0YWJsZTE1ARAGdGFibGU5AQoHdGFibGUxNAEPCcYGCgVwTdIFC9IFC9IBC9IFC9IHC9IGC9IBC9IGC9IEC9IIC9IEC9IIC9IDC9IHC9ICC9IDC9IAC9IAC9IHC9IIC9IFC9IDC9ICC9IBC9IAC9ICC9IEC9ICC9IHC9IHC9ICC9IDC9IHC9IDC9IGC9IHC9IAC9IFC9IFC9IHC9IHC9IBC9IEC9IIC9IEC9IIC9IHC9IIC9IDC9IHC9IHC9IAC9IBC9IAC9IHC9IHC9IBC9IDC9IBC9IHC9IIC9IHC9IDC9IAC9IHC9IIC9IAC9IGC9IIC9ICC9IEC9IIC9IBC9IEC9IFC9IBC9IHCwdwKdIEC9IGC9IBC9IBC9ICC9IHC9IAC9IAC9IAC9IGC9IGC9IAC9ICC9IEC9IIC9IBC9IFC9IIC9IAC9IFC9IHC9IHC9IBC9IHC9IDC9IHC9IFC9IDC9IHC9IGC9ICC9IDC9IBC9IFC9IAC9IHC9IGC9IFC9IDC9IIC9IDCwMAFgQAAwQFBgMBBQQDAQYEBgYFCAUBAwcDAF4DBQUGAwMIBwAAAwIGAgUAAwIDBAEGAgUGBwIFAQACAgcDBQEHAwADBQIABAgEBgIEBQcBAgEBAwgHAgICAwUFBAQAAQIBCAQEBQcEBAIFCAgHAgcDAwUHAwEDBwcGBXBj0gEL0gQL0gML0gcL0gAL0ggL0gQL0gQL0gQL0gUL0gEL0gML0gAL0gQL0gML0ggL0gYL0gUL0gML0gUL0gAL0gYL0gML0gIL0gcL0gEL0gUL0gEL0gML0gIL0gEL0gcL0ggL0gcL0gcL0ggL0gML0gEL0gAL0gcL0gYL0gML0gIL0ggL0ggL0gcL0gML0gAL0gML0gAL0gcL0ggL0gcL0gcL0ggL0gcL0gUL0gQL0gAL0ggL0gYL0ggL0gYL0gAL0gUL0gQL0gEL0gYL0gIL0gEL0gEL0gAL0gAL0gIL0gIL0gYL0gUL0gcL0gML0gQL0ggL0gEL0gEL0gUL0gIL0gAL0gcL0ggL0gIL0gYL0gQL0gYL0gQL0gUL0gEL0gcL0gML0gcL0gYLAgVBGAsAAgADBgVBHgtwAtIBC9ICCwYCQQALcALSBAvSCAsCBUEZCwACBQYGD0HaAAtwAdIHCwwBBQrLTgP/EgYCfgB8A38BfgF9AXwgALokCSAAeiMKIw0QCD8A/BAFcCUF/AkDBn5CrQEkAAZ8QRkRAAUkB0E1JAsDABAH/BAFQQJwBAIGfxAFRQRADAMLIwlCrAECQAYEBgUgAAZ9A34gAkEBaiICQQJJBEAMAQsQByAABm8QAQwHC0TBXKCRobBK2SAADAkACwwIC/wBDwsMAQtC3Kqq1c6w1fZ10gIgAQwFC9IIBnwMAgELDAMLGkEADgEAAAsCQAIFIwcOAgEAAQsGASABQdK8DUEBcA4BBAQBGRABIwkMAwskBgtCANIHBn/SAERnJMmm6K4ZT0KW2yTDJADSByMHA3wgAQwEAAtE0mYbYcjjxKkMAgsMAwALPwAPCyAAPwANAMQiAAwACyQAQeOlA0MRqidBA3wgAUQc7Cz7udVQztIF0gNDSbyhHIsgASMLDAEAC5sCfQYDBkAYAAwACwJ9AwECAwwAAAtCEyQAQfUADwALAAsAC9IAIAEjAtIBQuIABnwDAQYGGAIQAgJA/BAADgEAAAsjAUPbptWlIAH8EBAMAgALRM1sJew2PYROPwANAAwACyAAQtCh6IPJ1AAhAUO2ASRF/AUGfdIA0ggjAwZwPwD8EA0NAkECcAQAIADDQidDXlObMvwEBkAGfwwBC0EBcA4BAAALUCQEAkAMAAALBm8CAUNfwKKjDAQAC9IEIw4kC/wQEEECcAQEIwtB8/GnMk1B4zgMBQAFIwUMAwALQSRBLkEo/AwEAtIC/BAKDAQL/BABPwCsIAEgACIAJAAhACEBQf//A3EgASAA/kwAACIB0gLSByML/BAOQQJwBH7SByAAAn4Cf0EeEQYFQQtBOEER/AwABQIDAnAgAAwEAAsACwALAAsABSAADAAACz8AJA4CfQYGAwJBHhEDBQJvIwH8B8IkAENKCebOIABCm7bnRCQAJAAMBgALAAtEZVwlYh4by38jALn8BwJ/EAEGBgwCCwwBAAsCfAwBAAufvSIAvyQBDwtBGhEABUQnnyKWssFCPCQBJAtDMZR05QwAAAsMAgAFEAJDRCaYJfwQAQwDAAv8EA1BAXAOAQICAAv8EBD8EAUPCyABIwkkAbUkCPwBIwL8EAdBAnAEfiAA/BAJJA4kAAMAIwZD/cqMTSMNBnAQB0SW5pcGxyYqhgJwAwECAiAHRAAAAAAAAPA/oCIHRAAAAAAAADJAYwRADAULDAAACyABDAQACwAL/BAHDwskBj8ADAIACwwBBQIDDAAAC9IEQuPOvLzlyp/8ZgZ+IAAkAEEfEQYFBgQgAQwCCyQGDAALIgAMAAsiACQAIwRBAnAEAz8AQu0BPwBBAXAOAQAAC9ICQ8OesDI/AEECcAR+BgMCAgYAIAAgAQwDCw0A0gEGfQwCC5FBhwz8EAJBAXAOAAML0gEgASAADAELBgP8EAf8EAFBAnAEBQUGfETz/6jRp5RBmSMFQ66d09dBkBdBI0EQQSX8DAAPDQL8EA4GfAZwRP+o4yIXE2bwQdfhqbwDDQMGfwwEC0ECcARwDAQABQZwAgUMBgALQwMcqFokCAYFGSMD0gZBvs29B/wQAUEDcA4KAAYHBwYABgAHBgYL/BAPQQJwBH8GBBABDAgLDAIABUI/DAgAC0ECcA4CBQYFCwJ8DAUAC0RcFdRIfIDMxZ1mDAcLBkAMBAvSBgN/BgYGBQMBAwRDFKtF8CQIBgZEM3kGTHKhkuHSB/wQCA0AQjEMCwsCQAwJAAsACwALQn9C1LDk756AwrwziCABPwBBAXAOAQgICwwFCyAGQwAAgD+SIgZDAAAQQl0NAAYDBgAjAQwEC0H7AEEDcA4DBgUAAAsMBQALQQJwDgcDBAQDAwMEAwsgAUKs18+d36B0Bm8jDgwGBwMjDUQj87ETSmDI7QwBAAsjAkPkHLN/JAj8EAIPCwwACyMODwsPCxACBgACfBACQR4RAgVBHxEDBQYGAkDSAyABA30MAQALAAsGcAwBAAvSBNIAIABC2wEDcBAFRQRADAELBgMMAgvSBiMEDwALBnBCpNndgusCA3AMAgALROrPTR2nftsCDAILJAYGQAwAAQv8EANBAXAOAQAACxABAnwCQPwQCQwDAAsACwwAAAtEj8x5hWOkk8v8Aw8LQQJwBAUFBgEjDPwQBEEBcA4BAQEAAQALQTBBEkEB/AwAAgNwIAVCAXwiBUIaVARADAELRAxLXwFWwMugBn4CBSAFQgF8IgVCHVQNAhAFRQRADAMLDAMACwIDQusADAEACyAAIAAMAwsjBSABtEH9oQ4GbwIFBn8gAEMAAACAjkO5wpx/AkAMAgALu5lBhpWKxwUMAAsgAAwECwwCAQvSBEHBACQLQvcAukQAAAAAAAAAgPwQDkEBcA4BAQEL0Q8BC9ID0gEgAAZ+Q16Q+TKR/BAADAILDAABAAUGBPwQASQL0gLSBAJ9AnxBIUECcARADAAABdIHIwRBAXAOAQAACyMDDAEACwALIAHCDAEHBAYHEAgCQAwAAAv8EAREtVX5rIg4+X9BLEEWQQ38DAQNIwwkDAkBCwIAAgVEvhHC/QdiN4sjBiQKJAkGACMEDAALQQFwDgAAAQELIw5BAnAEAkKRAfwQB0EBIwdBAXAOAQAAAQsCfdIA0ggjAiQM/BAGA33SAkNFLN6b0gYgAdICIAG1DAEACwALJAM/AA8AC0QT+335BABiLkEqQRxBB/wMAAUGbwZwBgIMAAsCAgwAAAsCBQwAAAsjASMEBAMGBQcDAgcGB9EMCAELDAIAC0LlAQwFCyAADAQBC5tCJCQAQbjUHwwECyMHDwvSB9IDIABENpI9efcTz7f8EAsPCz8ARC56pS/tgPf/Am8CbwMD/BAPJAsGBgICDAAAC0HeACQOQuPpfkJ5RPU7AM2WJxPLQzzcLlxBMkEEQQz8DAQPIwQPAQsgBkMAAIA/kiIGQwAAAEJdDQADBiMLQsEBuj8ADwALAAsACwAL/BAK0gNDJkX3iiQDIAF6AnxEqfrJ1wUjm+tEiKcQePTVcjMMAAAL/AckAAwACyQABnBBiJcBQyndNei8QQFwDgEBARkCf0LUg/u6qoUBJABByvuiCQJvIwUMAgALAAsPCyQFJAggAANAIAVCAXwiBUIfVA0AIAJBAWoiAkEaSQ0AAgQCBgwAAAsGfUPfZSugDAABAAtB0wBBLUEG/AwAD/wBDwALAAsGf/wQCNIAQRtBBUEk/AwADSMEDAAL/BANDwvpMAQDfwF+AX0BfEGy2ezHAUH//wNxMgD6ASMEBn9BMyQOAgUMAAALQ7BqfR8kA0RjPQHTEQ0tS0PH919jQhkkACMKIwQMAAsjDSQGQQJwBAYMAAAFBgQCBAYBDAMLJAoDcAN8EAJBHhEFBQYEEAEMBQsMBQALAAsACyMBtiQIGAEkCiMKDAEBAAALQdUB/BAPcCUPIwkGfyMHQQJwBHBDHUdDnyQI0gUjCJEGfUMcWnM8/AEjDgwCC9IGQ/Rn1X9BoAFBAnAEb0HOAEECcAR+QZ0CQQJwBAQQAQYFIwQMBQEACxACPwCzBm8GBQJv/BADBH4jCw0CAgIQAQwDAAsABRAB/BANDAgACwwEAAskAgwACyMAIw4MBQtB67756gNBAXAOAQICAAVBHhEGBRAFQR5B0gBBDvwMBAJBAnAEb0Hc0+o//BAFcQwFAAUCAwYFIwYCfgZ/AgXSAUENDAEACwwCC0KUi1AkAAwIAAsjB0ECcAQCDAEABQIAEAUMCQALAAskAAwGCwYGAgIDABACDAEACwALGAcMAAALQQhBxgBBBPwMAAUGAUHtAAwGCwwEAAsMAgALQfMBDAMF/BAFBHAjCgwDAAUjA9IDRBxY8xHYgyOrAkAGBQwBC9IH0gNCy3FBLwwFC5ydJAk/AAwEAAsMAgAL0gbSBiML0gcjAMO60ghDJkQRzEPafK/UIwhBBrdEB8PWTZfpkgmbQdT+A0GJnpG7BUH30AH8CwAGfgYGDAABCxACIwX8EA9BAXAOAQICCyMAhyMMQraai7zIACMCDAAFAgYMAAALEAIGAgwACwIFDAAACyMMQdQB0gEjDgwCAAskDCMNIwPSCEHGveD+AQwBAQVDDPEtBtIIIwj8BAJ9Qg1EAAAAAAAA8P8kASMBJAnSA0KTgMuv9bbLAQZ/AgQCBvwQDAwFAAsACw8LIwH8AkEBcA4BAgIL0gcjDCMEDAEACyMF0gXSAUKDgLjV9AgCbxAFJAsGAAMCQ7eBgXVEn89yc/9ad8dCzgEjASQBJACcJAEkAwIBA28QBUUNACAAQQFqIgBBJkkEQAwDC/wQCAwDAAsACwALIwL8EAsNAQwBC0Sq2odKabjxf/wQCwwBAQtEWmeVGMPsXtUDfQJ9IABBAWoiAEESSQ0BAgUgAkEBaiICQQRJDQIMAAALIwIkDCABQQFqIgFBH0kEQAwCC0ERQc0AQRP8DAQFIARDAACAP5IiBEMAADBBXQ0BIAFBAWoiAUExSQ0BIw4kBCAEQwAAgD+SIgRDAAAAAF0EQAwCCyAFRAAAAAAAAPA/oCIFRAAAAAAAAERAYwRADAILIwD8EAsjBiMBJAEjCUELQSlBG/wMAAXSAUQ9p7zhcOltgwN+IwMMAQALAAu7Q8IFfdb8EAkCbyAAQQFqIgBBG0kNASMMDAAACyQC/BAEcCMCJgRBnMo7QtkBQ69GxaAjBEECcAQDQRoRAAVpQQFwDgEAAAv8BVVuBn4CBAYGEAVFDQMMAAEACwMFIwxDAACAfwZ9Iw4Gb/wQAQwGCz8ADAUAC9ID0gD8EAMCfiADQgF8IgNCElQNAUNuPNd/PwBCncPqkHtQIwsMBQALAAsACwwDCz8A/BABQQFwDgEBAQsCb0Tqcfte6v6Y8gJvAgYMAAALBgAGACMC0gIjBQZ9BgUGBUHR0oaneUECcA4IAAABAAAAAQEBC0EfEQIFDAALBgUCBQwBAAsMAAsjDvwQD3AlDyQNIwgMAAv8BEOOpC2JQiH8EA8MBAskB0ElBn0CfgJ8Q2ywlSfSAtIA0ggjBj8AJAQCfCMMDAUACwALAAvCJAAGBERsf4HRybCi1SQBIwYGQEEfEQYFDAALIwQMBQELJAYkAAYFC0P8m4pnGAMjACQAQTVBxwBBDfwMBA1B9LLwiHgjAL8kCQwACwwCCwwAAAsGcCMCA0AGACMAIwCIQtsBIw4MAwskDvwQCrOM/BAAQRhBxwBBAvwMBA8kB478AQwCAAv8EAskB0KNdNICQ6YfNG0CbyMORQwCAAv8CQL8EAP8EANBAXAOAQEBAAtBy/jW/QAMAAtBAnAEfAYBBgMMAAsGfyMHDAALQ6y2pEsGQAN9BgMjDdIDQ+RYUVgkA0ICJABDCR2LwZECbwYEQ/pLRDIkCAICDAUAC0SMDnUXE2ACQ0LtACMBDAYL/BAODgUGBgYGBgYLJAICQESLcZd3RNogi/4DAAwFAAuLAnAMAwALIwtBAnAOAgIAAgEAAQsMAQALQx1jlvUGb0ToIwuliuzjaNIDPwCzvEEBcA4BAQELQgc/AEEBcA4BAAAL/BAG/BADcCUDIwojASQBDAALJA0GARAC/BANJAf8EBAEAAYD0ggDQCAAQQFqIgBBAUkNACABQQFqIgFBFUkEQAwBCxAFRLgVF7JX60+TBm8DQAJ+QZ/w0gVBLEHBAEEE/AwAAgwFAAsACwYEIwwjAAZ/BgUMAAsDASADQgF8IgNCHVQNBAYDQxQPqAaQQuKR583XQdII0gbSBUEiQcgAQQT8DAAP0gICcAIGAgIQAgIFDAIACwALAAsjByQHEAVFBEAMAwtCKbT8BPwQDgwDAAvSAkO09eCw/BAGDQAkA0PMr9pkIwI/AAR8DAEABQIAIABBAWoiAEESSQ0HIwJBKgwAAAskBCAAQQFqIgBBJkkNBgMAEAVFBEAMAQtBpcjZqAMMBAALAAvSBSMKJAX8EA4NBiMCDAQLIAFBAWoiAUEcSQRADAUL0gDSCEPC9+V9jY8CfURewrHIl8JkCvwQCEEBcA4ICQkJCQkJCQkJC/wQDAwBAAsjBgwGC0EBcA4BAwMLIwg/ACQE/AX8EA4Gf9IIBn8GA0L31qJ/IwcEAAYB0gMjBgwJCyQFDAEABQYCBgUMCAtDkwZTnUObgjwsJAjSBvwQCA0APwBBA3AOAgAHAgtCtuvN1o+d460BJADSCCMA0gNEAAAAAAAAAAAMCQALDAIBAQsjCwwACwwACwwDC0I5An8MAgALAAsjDiMEQQJwBG8GAgYFAm8Gb0HPmQFBA3AOAwUDAgULIwcDfAwFAAsACyMOQQNwDgMAAwEDCwYGIwgjBSMB/BAIDQAMBgsMAhkDAAwBAAtBAnAOCgICAAIAAAICAgAACwJ/DAIACwAFEAEGBgwACwYAAwMjC0ECcARAAgECBQwCAAsACwAFIAFBAWoiAUExSQRADAILEAVFBEAMAgsMAAALEAJEo3KmR0wBewgMBgALDAILDAIACwNvQ93ap1XSAyMIBn0GQAsQBUG124nVfQ4BAwML/BAQDQEGcAwCCyQGiyMOQ7h6wylD7O2O1wJ9AwUgAkEBaiICQSJJBEAMAwsMAwALAAsACyQMQufx15F7wwZ8DAELIwJDO9Vm2wZ+AgUMAgAL0gD8EAUaQQkOAQEBAQsGfQYFA0BETPcz90+ASTkMBgALQt4AxKcMAwsGfQwCC7wMAgv8EAkkByMBIwxB9bkCQQVBAfwIAQAkDAwDAQtC9QBEyESUI4TRg+8CfwZ9Iwn8EATSBAJA/BAKDQDSByMODQDSB0GrAUTcZslDP7RTaAwFC/wQAEECcAQA/BABDAMABSMJ0gTSAQZ/Bn8/AEECcAQAEAJBleq5onoFBgJEFPg6AmUqLGIMCQsGfQIDRArf2dqGysMxJAkMAAAL0gEjBAwGAQsGfUEiQRlBDfwMAAIGBgcFAgRBuvccDAUACwwJAAsjBtIHQ4Q/8r0MAAskA0Hn0Z/XAwwDAAvSByMHDAUAC/wQCgwACwwACyMF0UECcA4CAQIBCz8AIwtBAnAEBQwAAAUjCwwCAAs/ANIFQ2LdNh9Bqd6wDgwBCwwABQJ/RMGHAsOGF/H/QvuGrfHl3dM9wqdBAnAEQAJwDAEACwAFDAAACyQBRK8ATulIOIX8A34GAAZABwIQBUUNAvwQDQ0A0gADcBAF/BAHPwAMBQALBnAMAQsjDvwQAwwDAAsGACMBDAYLQbQBDQMEfxAFRQ0CAgBBqvvGDwwBAAsABSMA0gAjCPwFIw4MAAALrNID/gMAQ29AW64kAyMIQmf8EAX8EAgMAwsMAQAL/BALDAELJAsCAUKnr9K0CnmnDAEACz8ADAALIwkjCCQDAnAjBfwQDkECcA4CAAEBCyMB/AIkCwJ90gcjACQAAn0jByMDIwRBAnAOAQABCwJ+IwQkCz8AAnBDWFO3vfwQCgQE0gHSBdIGQcEAQRdBA/wMBAICcCMKDAUACwAFBgMMAAsjAwwDAAskCiMG0gDSAiMFDAMACwAL0gL8EAoGQAwAAAsjAEQhEp2L4+5gxiMHDgECAgskAz8AQQFwDgEAAAskBdIDRMLnx8JPILMVDAAFQR8RAwUjBEECcARADAAABQJ9QeoMQQFwDgEBAQsjBtIBIwkGfgwBCyMODgEAAAsGbwNwAgEGBQMABgYYAUOQ9rd/Iwb8EA0jDkEBcA4BAQELDQAgA0IBfCIDQgVUDQIQBSMHQQFwDgEAAAtBwoHjpXg/AEECcAR+QR4RAgUGAwwAC0Gg7QNBEQZ/AwAQASMIQe8cQQJwBEDSBfwQAgwCAAUGBdIF0gHSAyMADAQBCwYCDAALDAAACwZ9QYMBQQJwBAMgBEMAAIA/kiIEQwAANEJdDQYgAEEBaiIAQQlJBEAMBwsgAUEBaiIBQSdJDQIQBUUEQAwHCwZ/AgQgA0IBfCIDQi9UBEAMCQsQBQJADAAACwwFAAsMBgu+JAgGfBAFRQ0DBgYYCgZ/IAFBAWoiAUEFSQ0I0gX8EA0MAAtBAnAEAUSxqBI9Mdmg1wZvEAVFDQkGBhlE2S+Tpr3OQSdCpgGnQQJwDgIABAQBCyADQgF8IgNCFFQNBRAC/BANQQFwDgQDAwMDAwv8EBANCQwJAAUgAUEBaiIBQRBJDQQMAgAL/BAHQQFwDgEBAQtCoQH8EAtBAXAOAQAAAAALAgUGBQwACxAFQQFwDgEAAAtBHxEDBSACQQFqIgJBEEkNBQYAAgMMAAALIwYMBQtBAnAEcAYDBgILAwAQBUUNACAFRAAAAAAAAPA/oCIFRAAAAAAAADJAYwRADAULIwQMBQALDQAGBAwBCwJvRKPg/+eJQLRQDAoACyMFAn4CBiMMIwsNCgwKAAsACyMGDAELIABBAWoiAEEbSQRADAcLAgYgBUQAAAAAAADwP6AiBUQAAAAAAAAcQGMNAxAFRQRADAgLQquB65e6fiQAIwcEbyACQQFqIgJBCUkNBCABQQFqIgFBEUkNCCAFRAAAAAAAAPA/oCIFRAAAAAAAAAAAYwRADAkLQR4RAwUgBUQAAAAAAADwP6AiBUQAAAAAAAA3QGMNCCAAQQFqIgBBAkkEQAwFCyACQQFqIgJBEkkEQAwFCyAEQwAAgD+SIgRDAAA8Ql0EQAwFCyABQQFqIgFBAUkNCCAAQQFqIgBBLEkEQAwFCyMFDAIABSMMDAkACwJvBm8gAUEBaiIBQQ5JBEAMBgsgAEEBaiIAQRZJBEAMBgsgBEMAAIA/kiIEQwAAgEFdDQkCBgMB0gRDAACA/7sMDQALAAsjBQwDC0M986qzDAMACwAL0gQjAgwHAQUgBUQAAAAAAADwP6AiBUQAAAAAAABHQGMEQAwDC0K3y8WZ482Tv30CfiAAQQFqIgBBHkkNAyAAQQFqIgBBIkkEQAwIC/wQAgwEAAsAC0Qr7uc2jK4PIAwHC2AMAQALDAALJA4GQAYDDAEBC0O4BhD7IwRBAnAEfwwBAAUCfgwCAAsAC0ECcARwIAVEAAAAAAAA8D+gIgVEAAAAAACAQUBjDQQCfhAFQQFwDgECAgu6JAkMAQAFDAEACz8AQQFwDgECAgtvJAdC+VQMAAUjAEOb8cmePwBBEkHVAEEJ/AwEAiQL0gcjB7cMBAALJAD8EA9wJQ8MAAsjDCQC0QRvQY/hACQOBgUGBQYBDAELQ+XxepMkCCQFC0EaEQAFQQFwDgEAAAsCBSMF/BAIQQFwDgEAAAsgA0IBfCIDQh1UDQECBSAEQwAAgD+SIgRDAACQQV0NAkNNLoKP/AD8EAUaQQAOAQAACyACQQFqIgJBJEkEQAwCCyAEQwAAgD+SIgRDAABEQl0NAUEBJQgkAgJvQabOBUSmdtfrfnhGgwN+IABBAWoiAEERSQ0ABgMLIARDAACAP5IiBEMAACBCXQ0AIAJBAWoiAkEtSQ0DIwUkBUL2ACQAIAVEAAAAAAAA8D+gIgVEAAAAAAAALkBjDQMgBUQAAAAAAADwP6AiBUQAAAAAAABGQGMNAEQpAxZMcoEduAwFAAsACwAFIAVEAAAAAAAA8D+gIgVEAAAAAAAAQ0BjBEAMAgsgAUEBaiIBQStJDQECAQMG0gUaCyMFBkAgAUEBaiIBQShJBEAMBAsgBEMAAIA/kiIEQwAA4EBdDQP8EAVBAXAOAQAACwwAAAsCQAJABgEMAgAL0UECcA4CAQAACyMEQQFwDgEAAAsCf0LyncfbAUG6ASQLQcsAQR1BDfwMAA96GkGZgOn7AAwAAAskCyQGIAJBAWoiAkEmSQ0BBgBE4gzym8jXXyAMBAskDhAFJAcgAEEBaiIAQSVJDQFCnwFDwLTyehoGfCMJCyQJJAAGfSMAJABBp8KYAyQEBgMgA0IBfCIDQgpUDQNCtAEaAkALAgBEUBWyNJefB5YMBgALQQFwDgEAAAALIABBAWoiAEEBSQ0CAwRBnNUDQaYBQaog/AsAIAJBAWoiAkEvSQRADAELBm8DAwIEIAVEAAAAAAAA8D+gIgVEAAAAAAAA8D9jDQFC5pnWatIFQQkjDiQHQeUAJAskCxpBMyUFDwALAAsjDAwDCwwCAAsPCyQDBnxDGtTp9wZwQTIlDyQFQSklAvwQBA0AGAAaJAg/ABogA0IBfCIDQgNUDQLSCBojDCQCIwkkAUNaAsP/Bm8CfUMR+rh//BAOQQFwDgEAAAuNIwYjCCMGGkHHmQJB2QBBgtUA/AsAJAhB6Z73xgNBAnAEfPwQBSQLAgUCBQsCBQZv/AkEIARDAACAP5IiBEMAAJBBXQ0HDAILDAMACwtENHRM5V4wHV1EsQwfSwOo0f9kQQJwBAFBKCUCQSpBBUEY/AwADQwAAAUDBBABQsoBQQdBB0E//AwAD3oGcEEzJQ8jBEECcA4FAgIAAgIACwskBkNNJTFWJAj8EBBBHUHUAEEM/AwEDSQO/BANPwAaJAcaBgUgBUQAAAAAAADwP6AiBUQAAAAAAIBGQGMEQAwHCwZ9QQoOAAELGkRwV0bUyh1aSyMBDAQAC0E1JQ8L/BADGhojAQwCAAVEj7W4VBXJGc4jDSMDJAMkBQwCAAtChgEjASMO/BALJAtBAnAOAgUBBQAAAQsMAQELtkPjdNT/QfoBJAv8BUHUxAJB+8wBQcbZA/wKAAAkACMBDAMLDAEACyQGEAECBkG/9QlBAXAOAQAAC0T5eiyQdo18qtIHIwgkCCMEQf//A3EyAf8HPwAkDiQAQg4kANIF0ggaPwAkBBrSCBojCCMJnANwIwv8EANB/v8Dcf4TAQBJBG8DASMFC0EEQTpBBPwMAAUkCgYBBgBBBgwAC/wQACQOQQJwBAFCggEkAAYBEAVFBEAMBQsjCgskDSAAQQFqIgBBAUkNAwICC0EKJQUMAAAFQQ0lDQwAAAsLJAogAEEBaiIAQSVJBEAMAgsCAQIDA34gAkEBaiICQQZJBEAMBQsjAgwDAAsACwALAAUQBUUNASAFRAAAAAAAAPA/oCIFRAAAAAAAgEFAYwRADAILIABBAWoiAEEtSQRADAILBkAQBUUNAgJvEAVFBEAMBAsMAQALJAILAm8jAiQCIAVEAAAAAAAA8D+gIgVEAAAAAACAQkBjDQIjAiQMQRkRAAUkBwMBIANCAXwiA0IaVA0AQRYlBQsjAiQCQ+E6OJwDQCACQQFqIgJBHEkNAAskCCMEQQJwBAMQBUUNAwVByQBBBUEB/AwADwYDDAABAAcHJAb8EBBBAXAOAQcHCwwAAAskBUE4JRALDAIACyQC/BALJA4gA0IBfCIDQiFUDQAGASMF0ggGcAYDCwYCCwN8BgEjBgsMAQALDAQACwwACwvSCBokDdIFIw78EBBB2qLv+X1pBnxEzSbuiJ8H8/8LDAELJAxEamaYFgdq/McLIwdBAnAEAAYFDAALQQgMAAAFREbdrlnTLaMiIwkkCb1DZr5I8yQDGiMNIwQMAAALJA5BNUECQQP8DAQCnSQJn/wH/BAFJA4kAPwQB0GcAXgjAgZADAAL/BAAJAckDPwQEHAjDCYQJAX8EAJwIwUmAtIFGiQAIw0kCkL0ALQkA0OGGs+I/AQjBQwAC9wKDAFwAX0BcABwAXABfgJ/An8DfwF+AX0BfEIEIAUgCUECcAQBIwJEmJGEmzWbtE0CfgMBAgRDhxgXbz8ADQQCfQMBIA9CAXwiD0IdVA0AQay16wIEARAFRQRADAILAgAQBUUEQAwGCyMNIwkDf0GAw7LxAkHLAfwQCHAlCAZ/BgD+AwAGfBAFDAILIAsOAQsLCwwACwwBAAsACwJ/Q27O1JX8EApBAXAOAQMDAQtBAnAEbwYEIBFEAAAAAAAA8D+gIhFEAAAAAAAAEEBjBEAMBAsgDEEBaiIMQQlJBEAMBwsCAyANQQFqIg1BHUkNByARRAAAAAAAAPA/oCIRRAAAAAAAAD9AYwRADAgLIA5BAWoiDkEESQRADAULDAAAC0TJbQ/IrEVkoCQJBgIGASAMQQFqIgxBF0kNCCAH/BABIQsMCQsiBiAIQQJwDgIACgAL/BACAm8MCgALDAELIAEMBwVEn1B0/i0lCqzSBQZ8AgUgDEEBaiIMQRtJDQcCAUGekzwOAgELCwsGQCAQQwAAgD+SIhBDAAA4Ql0EQAwJCyABIAYMBAsMCQsQBUUEQAwHCwJ+IAxBAWoiDEEqSQRADAUL0gfSBwJwAwRE/koZmJ7aVwwCfSMKIwL8EAX8EAlwJQkGfwYDAgZC1gAMBgALDAALQR4RAwVEIcW643Za6fcMBQtBAnAEA9IB0gZC/gG6IAsNAAwFAQsgBCMN0gBCAfwQCQ4KAwsDAwMLAwsDCwMLBn8CQAwAAAtBrL2SAkECcARAIw4MAQAF0gQgBQwNAAsQBUUEQAwICxAFRQRADAILDA0LAn8gDkEBaiIOQQtJDQcgEEMAAIA/kiIQQwAAiEFdDQpE8d+tYXrb8j4kCQZ8IAEMAwtEAAAAAAAAAAAMBAALAAsGfA8BAQsMAgsMCQtBMkNEFPlVQQD8EAENCUH//wNxLACJBQ0EDAQAAQsGQBgIJAEGfD8AIAlBCyAAQs2A+6jw498WRPnwTBKrE6F8DAALJAkgACQA/BAMQQFwDgEICAtBzQENB/wQCUEBcA4BBwcABQwHAAsiBgwFAAsjCCEEDAQL0gjSB/wQDkECcAQADwAFDAUACyAFRCcgh/3L0IH2/AMaQQAOAQQECwwCAAsMAQsjBSMEQQFwDgABBSMGQvsBQtfjeCIHQt8Bp9IG0gVBw6bZlwMNASMM0gU/AA0BIwFDS9gus/wQAg0BPwANASQIJAH8EAQNAUEADgEBAQtBH0EyQQf8DAQFAggCCAYHDAIBCw8ACwYHDAEAAQsGBgwCCw8LIgUGCQJ/IwxBnN0CQZbk5sF9QaWZA/wLACMGIQX8EAtBAnAOAgECAgtBAnAOAgABAQELBgIGcEGOI0ECcA4CAQICC0MV8y76IAZEoi39JnDO6BogCEECcA4CAAEBC0LTAUNoINxNIw0jBgJ+RGvBjyYvu/7/JAEMAQALIwQNACEHQsvwvf+tpAYDfQwBAAsCfdIDQRhB//8Dcf4SAABBAXAOAQEBC5T8EAcNANIGRIj9ofYg7ZTsJAlEbRco/q9piPw/AA0A0gcgBCAE0ghCl+e10rWMzn4GQAwACyQA0gIgAEPti7lgJAN7JAAgBP4DACQIQfKUyL0DIgkGb/wQDj8ADQFBAXAOAQEBC9IDQugAIgDCup4kASAE0gAgAUT5VMQ36FP4/0QsuEEPaxAXLaTSBEML3pYCBn0jDCQMRArwgfDpsXm6JAEGfSMKJA0MAgsGfkIbv55CAfwQDkEBcA4BAAALIApBAnAEAQwCAAUPAAtDzP+Ch7xBAXAOAQEBC0H7wq7lfQ0AIwtBAXAOAQAACws4BQEGDqbuLUjIAQg0Vk5W1CsQPABB27MDCwexNdp88N+BAEHRLQsBdQBBqKsDCwncWuNpl/7i/7Y=', importObject0);
+let {fn5, fn6, global1, global2, global3, global4, global5, global6, global7, global8, global9, global10, global11, global12, global13, global14, memory1, table9, table10, table11, table12, table13, table14, table15, tag0, tag1} = /**
+  @type {{
+fn5: () => I32,
+fn6: () => [I64, FuncRef],
+global1: WebAssembly.Global,
+global2: WebAssembly.Global,
+global3: WebAssembly.Global,
+global4: WebAssembly.Global,
+global5: WebAssembly.Global,
+global6: WebAssembly.Global,
+global7: WebAssembly.Global,
+global8: WebAssembly.Global,
+global9: WebAssembly.Global,
+global10: WebAssembly.Global,
+global11: WebAssembly.Global,
+global12: WebAssembly.Global,
+global13: WebAssembly.Global,
+global14: WebAssembly.Global,
+memory1: WebAssembly.Memory,
+table9: WebAssembly.Table,
+table10: WebAssembly.Table,
+table11: WebAssembly.Table,
+table12: WebAssembly.Table,
+table13: WebAssembly.Table,
+table14: WebAssembly.Table,
+table15: WebAssembly.Table,
+tag0: WebAssembly.Tag,
+tag1: WebAssembly.Tag
+  }} */ (i0.instance.exports);
+table0.set(34, table10);
+table11.set(22, table4);
+table0.set(53, table0);
+table10.set(3, table10);
+table4.set(14, table9);
+table15.set(68, table10);
+global2.value = 'a';
+global10.value = null;
+
+try {
+  for (let k=0; k<16; k++) {
+    let zzz = fn6();
+    if (!(zzz instanceof Array)) { throw new Error('expected array but return value is '+zzz); }
+    if (zzz.length != 2) { throw new Error('expected array of length 2 but return value is '+zzz); }
+    let [r0, r1] = zzz;
+    r0?.toString(); r1?.toString();
+  }
+} catch (e) {
+  if (e instanceof WebAssembly.Exception) {
+  } else if (e instanceof TypeError) {
+  if (e.message === 'an exported wasm function cannot contain a v128 parameter or return value') {} else { throw e; }
+  } else if (e instanceof WebAssembly.RuntimeError || e instanceof RangeError) {} else { throw e; }
+}
+
+})().then(() => {
+}).catch(e => {
+})