diff --git a/tcg/wasm32.c b/tcg/wasm32.c
index 20737312c6..f4d59a5dc4 100644
--- a/tcg/wasm32.c
+++ b/tcg/wasm32.c
@@ -138,6 +138,13 @@ int cur_core_num_max = 0;
 __thread static int to_remove_instance[TO_REMOVE_INSTANCE_SIZE];
 __thread static int to_remove_instance_idx = 0;
 
+int wasm_disable_tb_removal;
+
+EMSCRIPTEN_KEEPALIVE void wasm_set_disable_tb_removal(void)
+{
+    wasm_disable_tb_removal = 1;
+}
+
 void remove_tb(void *tb_ptr) {
     int32_t *slot = (int32_t*)((uint8_t*)tb_ptr + export_vec_off);
     int32_t f = *slot;
@@ -145,6 +152,11 @@ void remove_tb(void *tb_ptr) {
         return;
     }
     *slot = 0;
+    /* E18: leak the wasm function instead of recycling its table index, to test
+     * whether removeFunction index reuse is the corruption source. */
+    if (wasm_disable_tb_removal) {
+        return;
+    }
     if (to_remove_instance_idx == TO_REMOVE_INSTANCE_SIZE) {
         flush_tb_instances();
     }