// |jit-test| skip-if: !wasmStackSwitchingEnabled()

// Regression test for a return_call_indirect signature mismatch in the *entry*
// function of a continuation stack.
//
// The bad-signature trap tears down the entry function's frame, leaving the
// unwound PC inside the ContBaseFrame stub (not a Function CodeRange). Frame
// iteration must switch to the resume target on the parent stack instead of
// dereferencing a null CodeRange, and exception unwinding must free the
// continuation stack even though no frame is reported on it.

const PRELUDE = `
  (type $ft (func))
  (type $ct (cont $ft))
`;

// Basic case: the continuation's entry function tail-calls through a table
// entry whose signature does not match. The trap must surface to the JS caller
// as a RuntimeError rather than crashing.
{
  let run = wasmEvalText(`(module
    ${PRELUDE}
    (type $bad (func (param i32)))
    (table 1 funcref)
    (func $g (type $bad))
    (elem (i32.const 0) func $g)
    (func $f (type $ft)
      i32.const 0
      return_call_indirect (type $ft)
    )
    (elem declare func $f)
    (func (export "run")
      ref.func $f
      cont.new $ct
      resume $ct
    )
  )`).exports.run;
  assertErrorMessage(() => run(), WebAssembly.RuntimeError,
                     /indirect call signature mismatch/);
}

// Repeat many times: each trap allocates and must free its continuation stack
// during exception unwinding. A leak or use-after-free of the unwound stack
// would manifest here (especially under ASAN / debug assertions).
{
  let run = wasmEvalText(`(module
    ${PRELUDE}
    (type $bad (func (param i32)))
    (table 1 funcref)
    (func $g (type $bad))
    (elem (i32.const 0) func $g)
    (func $f (type $ft)
      i32.const 0
      return_call_indirect (type $ft)
    )
    (elem declare func $f)
    (func (export "run")
      ref.func $f
      cont.new $ct
      resume $ct
    )
  )`).exports.run;
  for (let i = 0; i < 1000; i++) {
    assertErrorMessage(() => run(), WebAssembly.RuntimeError,
                       /indirect call signature mismatch/);
  }
}

// The mismatch happens after a suspend/resume round-trip, so the bad
// return_call_indirect tears down the entry frame only after the continuation
// stack has already been switched away from and back to.
{
  let { start, step } = wasmEvalText(`(module
    ${PRELUDE}
    (type $bad (func (param i32)))
    (tag $tag)
    (table 1 funcref)
    (global $k (mut (ref null $ct)) (ref.null $ct))
    (func $g (type $bad))
    (elem (i32.const 0) func $g)
    (func $f (type $ft)
      suspend $tag
      i32.const 0
      return_call_indirect (type $ft)
    )
    (elem declare func $f)
    (func (export "start")
      ref.func $f
      cont.new $ct
      global.set $k
    )
    (func (export "step")
      (block (result (ref $ct))
        global.get $k
        resume $ct (on $tag 0)
        return
      )
      global.set $k
    )
  )`).exports;

  start();
  step();
  assertErrorMessage(() => step(), WebAssembly.RuntimeError,
                     /indirect call signature mismatch/);
}

// Nested continuations: an inner continuation's entry function does the bad
// return_call_indirect while running on top of an outer continuation. The
// RuntimeError must propagate out through both stacks to the JS caller.
{
  let run = wasmEvalText(`(module
    ${PRELUDE}
    (type $bad (func (param i32)))
    (table 1 funcref)
    (func $g (type $bad))
    (elem (i32.const 0) func $g)
    (func $inner (type $ft)
      i32.const 0
      return_call_indirect (type $ft)
    )
    (elem declare func $inner)
    (func $outer (type $ft)
      ref.func $inner
      cont.new $ct
      resume $ct
    )
    (elem declare func $outer)
    (func (export "run")
      ref.func $outer
      cont.new $ct
      resume $ct
    )
  )`).exports.run;
  assertErrorMessage(() => run(), WebAssembly.RuntimeError,
                     /indirect call signature mismatch/);
}

// After the trap is handled, the engine must remain in a consistent state:
// a subsequent, well-behaved continuation runs to completion.
{
  let { bad, good, result } = wasmEvalText(`(module
    ${PRELUDE}
    (type $bad_ty (func (param i32)))
    (table 1 funcref)
    (global $r (mut i32) (i32.const 0))
    (func $g (type $bad_ty))
    (elem (i32.const 0) func $g)
    (func $f_bad (type $ft)
      i32.const 0
      return_call_indirect (type $ft)
    )
    (elem declare func $f_bad)
    (func $f_good (type $ft)
      i32.const 42
      global.set $r
    )
    (elem declare func $f_good)
    (func (export "bad")
      ref.func $f_bad
      cont.new $ct
      resume $ct
    )
    (func (export "good")
      ref.func $f_good
      cont.new $ct
      resume $ct
    )
    (func (export "result") (result i32) global.get $r)
  )`).exports;
  assertErrorMessage(() => bad(), WebAssembly.RuntimeError,
                     /indirect call signature mismatch/);
  good();
  assertEq(result(), 42);
}

// Cross-instance: instance A does cont.new on a function imported from instance
// B, so the ContBaseFrame stub belongs to A while the first (and only) real
// frame to run on the stack belongs to B. When B's entry function does the bad
// return_call_indirect, the unwound PC sits in A's stub, but the frame's
// effective instance is B. Frame iteration and trap setup must not assume the
// stub and the entry frame share a Code/instance.
{
  let b = wasmEvalText(`(module
    (type $ft (func))
    (type $bad (func (param i32)))
    (table 1 funcref)
    (func $g (type $bad))
    (elem (i32.const 0) func $g)
    (func (export "f") (type $ft)
      i32.const 0
      return_call_indirect (type $ft)
    )
  )`).exports;

  let run = wasmEvalText(`(module
    ${PRELUDE}
    (import "b" "f" (func $f (type $ft)))
    (elem declare func $f)
    (func (export "run")
      ref.func $f
      cont.new $ct
      resume $ct
    )
  )`, { b: { f: b.f } }).exports.run;
  assertErrorMessage(() => run(), WebAssembly.RuntimeError,
                     /indirect call signature mismatch/);
}

// Same cross-instance setup, but instance B performs the resume: A does
// cont.new on B's imported function and hands the continuation to B, which
// resumes it. The stub is still A's while the running frame is B's.
{
  let b = wasmEvalText(`(module
    ${PRELUDE}
    (type $bad (func (param i32)))
    (table 1 funcref)
    (func $g (type $bad))
    (elem (i32.const 0) func $g)
    (func (export "f") (type $ft)
      i32.const 0
      return_call_indirect (type $ft)
    )
    (func (export "resumeIt") (param $k (ref $ct))
      local.get $k
      resume $ct
    )
  )`).exports;

  let run = wasmEvalText(`(module
    ${PRELUDE}
    (import "b" "f" (func $f (type $ft)))
    (import "b" "resumeIt" (func $resumeIt (param (ref $ct))))
    (elem declare func $f)
    (func (export "run")
      ref.func $f
      cont.new $ct
      call $resumeIt
    )
  )`, { b: { f: b.f, resumeIt: b.resumeIt } }).exports.run;
  assertErrorMessage(() => run(), WebAssembly.RuntimeError,
                     /indirect call signature mismatch/);
}