[kateinoigakukun]

A return_call to a host function ran whatever followed it in the caller's code:

(func $tail (param i32) (result i32)
  (block $b (return_call $host (local.get 0)))
  (call $mark)        ;; ran after $host returned
  (i32.const 99))

A tail call to a Wasm function jumps to the callee, but one to a host function comes back to the next instruction in the moved frame, which tailInvoke expects to return. The translator emitted nothing after a tail call (the rest is unreachable), so that only held when the tail call was the last instruction of the function. Otherwise the dead code ran in the moved, smaller frame; the resumable-call fuzzer hit it as a read below the stack (SIGBUS).

The translator now emits a _return after a return_call to a host function, and after every return_call_indirect / return_call_ref, whose callee is not known until it runs.

	before	after
return_call $host last in the function	returns	returns
return_call $host followed by code (e.g. in a block)	runs that code in the moved frame	returns
return_call to a Wasm function	jumps to the callee	unchanged (nothing emitted)

Metrics

• Every wasmkit_tc_* handler, both dispatch loops, invoke and tailInvoke: byte-identical to main (arm64 release).
• WasmKit module __TEXT: +208 B (translator only); return_call_indirect / return_call_ref code gains one slot.