From b6d67a89bb626d23ca5102103c1f927cd90ca384 Mon Sep 17 00:00:00 2001
From: Evan Reichard <evan@reichard.io>
Date: Wed, 22 Jul 2026 21:57:44 -0400
Subject: [PATCH] tcg/wasm32: add opt-in ?noremove to leak TB functions

Skips removeFunction recycling of WASM table indices. nostoretci+noremove still
crashes 4/4, ruling out table-index reuse as the corruption source and leaving a
vCPU/IO-thread guest-RAM data race as the standing hypothesis.
---
 tcg/wasm32.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tcg/wasm32.c b/tcg/wasm32.c
index 20737312c6..f4d59a5dc4 100644
--- a/tcg/wasm32.c
+++ b/tcg/wasm32.c
@@ -138,6 +138,13 @@ int cur_core_num_max = 0;
 __thread static int to_remove_instance[TO_REMOVE_INSTANCE_SIZE];
 __thread static int to_remove_instance_idx = 0;
 
+int wasm_disable_tb_removal;
+
+EMSCRIPTEN_KEEPALIVE void wasm_set_disable_tb_removal(void)
+{
+    wasm_disable_tb_removal = 1;
+}
+
 void remove_tb(void *tb_ptr) {
     int32_t *slot = (int32_t*)((uint8_t*)tb_ptr + export_vec_off);
     int32_t f = *slot;
@@ -145,6 +152,11 @@ void remove_tb(void *tb_ptr) {
         return;
     }
     *slot = 0;
+    /* E18: leak the wasm function instead of recycling its table index, to test
+     * whether removeFunction index reuse is the corruption source. */
+    if (wasm_disable_tb_removal) {
+        return;
+    }
     if (to_remove_instance_idx == TO_REMOVE_INSTANCE_SIZE) {
         flush_tb_instances();
     }