From 5e3b06de0582c71ce2fdf5a07e56c256feed4d12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexander=20Thei=C3=9Fen?= <alex.theissen@me.com>
Date: Tue, 13 Oct 2020 09:39:57 +0200
Subject: [PATCH] Fix Instruction::CallIndirect stack height metering

The stack height metering for functions containing
CallIndirect was wrong. The code did not take into
consideration that is pops one value from the stack.

The effect was that the stack height of functions
using this instruction was higher than its real height.
---
 src/stack_height/max_height.rs | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/src/stack_height/max_height.rs b/src/stack_height/max_height.rs
index 2f7cde1..d74928d 100644
--- a/src/stack_height/max_height.rs
+++ b/src/stack_height/max_height.rs
@@ -288,6 +288,9 @@ pub(crate) fn compute(func_idx: u32, module: &elements::Module) -> Result<u32, E
 					.get(x as usize)
 					.ok_or_else(|| Error("Type not found".into()))?;
 
+				// Pop the offset into the function table.
+				stack.pop_values(1)?;
+
 				// Pop values for arguments of the function.
 				stack.pop_values(ty.params().len() as u32)?;
 
@@ -523,4 +526,28 @@ mod tests {
 		let height = compute(0, &module).unwrap();
 		assert_eq!(height, 2);
 	}
+
+	#[test]
+	fn call_indirect() {
+		let module = parse_wat(
+			r#"
+(module
+	(table $ptr 1 1 funcref)
+	(elem $ptr (i32.const 0) func 1)
+	(func $main
+		(call_indirect (i32.const 0))
+		(call_indirect (i32.const 0))
+		(call_indirect (i32.const 0))
+	)
+	(func $callee
+		i64.const 42
+		drop
+	)
+)
+"#,
+		);
+
+		let height = compute(0, &module).unwrap();
+		assert_eq!(height, 1);
+	}
 }