| 39e910be | 09-Apr-2026 |
Alex Crichton <[email protected]> |
[44.0.0] Merged backports for security advisories (#13007)
* fix(environ): repair unsound StringPool::try_clone()
The 43.0 release introduced a soundness bug in StringPool::try_clone(): the
cloned
[44.0.0] Merged backports for security advisories (#13007)
* fix(environ): repair unsound StringPool::try_clone()
The 43.0 release introduced a soundness bug in StringPool::try_clone(): the
cloned map retains &'static str keys pointing into the original pool's
strings storage. Once the original Linker is dropped those keys dangle.
Cloning a Linker, then dropping the original one, leaves a linker whose
registered imports could no longer be found, causing instantiation to
fail with "unknown import".
Signed-off-by: Flavio Castelli <[email protected]>
* Fix pooling allocator predicate to reset VM permissions
This commit fixes a mistake that was introduced in #9583 where the logic
to reset a linear memory slot in the pooling allocator used the wrong
predicate. Specifically VM permissions must be reset if virtual memory
can be relied on at all, and the preexisting predicate of
`can_elide_bounds_check` was an inaccurate representation of this. The
correct predicate to check is `can_use_virtual_memory`.
* winch: Fix the type of the `table.size` output register
This commit corrects the tagged size of the output of the `table.size`
instruction. Previously this was hardcoded as a 32-bit integer instead
of consulting the table's index type to use the
index-type-sized-register instead.
* winch: Fix a host panic when executing `table.fill`
This commit fixes a possible panic when a Winch-compiled module executes
the `table.fill` instruction. Refactoring in #11254 updated Cranelift
but forgot to update Winch meaning that Winch's indices were still using
the module-level indices instead of the `DefinedTableIndex` space. This
adds some tests and updates Winch's translation to use preexisting
helpers.
* x64: Fix `f64x2.splat` without SSE3
Don't sink a load into `pshufd` which loads 16 bytes, instead force
`put_in_xmm` to ensure only 8 bytes are loaded.
* Properly verify alignment in string transcoding
This commit updates string transcoding between guest modules to properly
verify alignment. Previously alignment was only verified on the first
allocation, not reallocations, which is not spec-compliant. This
additionally fixes a possible host panic when dealing with unaligned
pointers.
* Fix type confusion in AArch64 amode RegScaled folding
* winch: Add add_uextend to perform explicit extension when needed.
This commit fixes an out-of-bounds access caused by the lack zero
extension in the code responsible for calculating the heap address for
loads/stores.
This issue manifests in aarch64 (unlike x64) given that no automatic
extension is performed, resulting in an out-of-bounds access.
An alternative approach is to emit an extend for the index, however
this approach is preferred given that it gives the MacroAssembler
layer better control of how to lower addition, e.g., in aarch64 we can
inline the desired extension in a single instruction.
* winch: Correctly type the result of table.grow
This commit fixes an out-of-bounds access caused by the lack of type
narrowing from the `table.grow` builtin. Without explicit narrowing,
the type is treated as 64-bit value, which could cause issues when
paired with loads/stores.
* Review comments
* Properly handle table index types
Only narrow when dealing with the 64-bit pointer/32-bit tables
* Fix panic with out-of-bounds flags in `Value`
This commit fixes a panic when a component model `Value` is lifted from
a flags value which specifies out-of-bounds bits as 1. This is specified
in the component model to ignore the out-of-bounds bits, which `flags!`
correctly did (and thus `bindgen!`), but `Value` treated out-of-bounds
bits as a panic due to indexing an array.
* Fix bounds checks in FACT's `string_to_compact` method
We need to bounds check the source byte length, not the number of code units.
* Add missing realloc validation in string transcoding
This commit adds a missing validation that a return value of `realloc`
is inbounds during string transcoding. This was accidentally missing on
the transcoding path from `utf8` to `latin1+utf16` which meant that a
nearly-raw pointer could get passed to the host to perform the
transcode.
* winch: Refine zero extension heuristic
This commit refines the zero extension heuristic such that it
unconditionally emits a zero extension when dealing with 32-bit
heaps. This eliminates any ambiguity related to the value of the
memory indices across ISAs.
* Fix failure on 32-bit
* Fix miri test
---------
Signed-off-by: Flavio Castelli <[email protected]>
Co-authored-by: Flavio Castelli <[email protected]>
Co-authored-by: Shun Kashiwa <[email protected]>
Co-authored-by: Saúl Cabrera <[email protected]>
Co-authored-by: Nick Fitzgerald <[email protected]>
show more ...
|
| a0d5346d | 24-Mar-2026 |
Alex Crichton <[email protected]> |
Lift/lower refactors inspired by `map<K, V>` (#12753)
In reading over #12216 I found a few related but also somewhat
orthogonal refactors that I wanted to implement, and thus this commit.
Changes he
Lift/lower refactors inspired by `map<K, V>` (#12753)
In reading over #12216 I found a few related but also somewhat
orthogonal refactors that I wanted to implement, and thus this commit.
Changes here are:
* Handling pointer pairs for lists/maps/strings is now more uniform with
a single set of functions doing the lift/lower to flat/memory. Less
"FIXME 4311" spread throughout effectively.
* Conditional defines and organization of the `HashMap`-related impls
were tweaked, for example impls on `HashMap` are now unconditional as
well as `TryHashMap`. Some internals were refactored to in theory
reduce complexity, but this is also subjective.
* Lifting a `map<K, V>` now consumes fuel, a recent change, to ensure
that resource exhaustion in the host is limited.
show more ...
|
| 97361cce | 19-Mar-2026 |
Chris Fallin <[email protected]> |
Debugging: allow breakpoints to be set at "function start" by slipping forward to first opcode. (#12791)
LLDB, when instructed to `break main`, looks at the DWARF metadata for
`main` and finds its P
Debugging: allow breakpoints to be set at "function start" by slipping forward to first opcode. (#12791)
LLDB, when instructed to `break main`, looks at the DWARF metadata for
`main` and finds its PC range, then sets a breakpoint at the first
PC. This is reasonable behavior for native ISAs! That PC better be a
real instruction!
On Wasm, however, (i) toolchains typically emit the PC range as
*including* the *locals count*, a leb128 value that precedes the first
opcode and any types of locals; (ii) our gdbstub component that
bridges LLDB to our debug APIs (#12771) only supports *exact* PCs for
breakpoints, so when presented with a PC that does not actually point
to an opcode, setting the breakpoint is effectively a no-op. There
will always be a difference of at least 1 byte between the
start-of-function offset and first-opcode offset (for a leb128 of `0`
for no locals), so a breakpoint "on" a function will never work.
I initially prototyped a fix that adds a sequence point at the start
of every function (which, again, is *guaranteed* to be distinct from
the first opcode), and the branch is [here], but I didn't like the
developer experience: this meant that when a breakpoint at a function
start fired, LLDB had a weird interstitial state where no line-number
applied.
The behavior that would be closer in line with "native" debug
expectations is that we add a bit of fuzzy-ish matching: setting a
breakpoint at function start should break at the first opcode, even if
that's a few (or many) bytes later. There are two options here:
special-case function start, or generally change the semantics of our
breakpoint API so that "add breakpoint at `pc`" means "add breakpoint
at next opcode at or after `pc`". I opted for the latter in this PR
because it's more consistent.
The logic is a little subtle because we're effectively defining an
n-to-1 mapping with this "snap-to-next" behavior, so we have to
refcount each breakpoint (consider setting a breakpoint at function
start *and* at the first opcode, then deleting them, one at a time). I
believe the result is self-consistent, even if a little more
complicated now. And, importantly, with #12771 on top of this change,
it produces the expected behavior for the (very simple!) debug script
"`b main`; `continue`".
[here]: https://github.com/cfallin/wasmtime/tree/breakpoint-at-func-start
show more ...
|
| 1b59b579 | 09-Mar-2026 |
Yordis Prieto <[email protected]> |
Add support for map type (#12216)
* Add support for map type
Signed-off-by: Yordis Prieto <[email protected]>
* Add Map and MapEntry classes to support key/value pairs in component model
Th
Add support for map type (#12216)
* Add support for map type
Signed-off-by: Yordis Prieto <[email protected]>
* Add Map and MapEntry classes to support key/value pairs in component model
This commit introduces the Map and MapEntry classes, enabling the representation of map values in the component model. The Map class allows for the creation and iteration of key/value pairs, enhancing the functionality of the wasmtime component API. Additionally, the .gitignore file is updated to exclude build artifacts from the crates/c-api directory.
* Add wasm_component_model_map configuration support
* Format code
* Format C code
* Enhance component model to support HashMap<K, V> type
This commit introduces support for HashMap<K, V> in the component model, allowing maps to be represented as list<tuple<K, V>> in the canonical ABI. It includes implementations for the ComponentType, Lower, and Lift traits for HashMap, enabling type checking, lowering to flat representations, and lifting from memory. Additionally, the maximum depth for type generation in the fuzzing utility is updated to accommodate the new map type.
* Refactor component configuration to introduce map support
This commit removes the previous wasm features configuration and adds new functions for creating a map-configured engine. The `map_config` and `map_engine` functions are introduced to facilitate the use of the component model with maps in tests, ensuring that the engine is properly configured for map types in the component model.
* Add new WAST test for map types and remove map type definitions from existing tests
This commit introduces a new WAST test file specifically for testing various map types in the component model. Additionally, it removes the redundant map type definitions from the existing types.wast file to streamline the test suite.
* Update component fuzzing and dynamic tests to replace call_and_post_return with call
* Format code
* Refactor HashMap usage in typed.rs to use wasmtime_environ collections
* Fix HashMap initialization and insertion to handle potential errors in typed.rs
* Refactor HashMap handling in typed.rs to use lower_map_iter for improved iteration and memory management. Introduce new implementations for ComponentType, Lower, and Lift traits for std::collections::HashMap, enhancing support for map types in the component model.
* Fix map adapter trampoline compilation and alignment bugs
The translate_map function had two categories of bugs preventing map
adapter trampolines from working:
1. Wasm stack discipline: local_set_new_tmp emits LocalSet which pops
from the stack, but was called when the stack was empty (to
"pre-allocate" locals). Fixed by computing values first, then
calling local_set_new_tmp to consume them—matching translate_list's
pattern. Also removed an erroneous LocalTee that left an orphan
value on the stack. Affected: src_byte_len, dst_byte_len,
cur_src_ptr, cur_dst_ptr.
2. Pointer advancement: after value translation, the pointer still
points at the value start. The code only advanced by trailing
padding instead of value_size + trailing_padding, causing every
loop iteration to re-read the same memory.
Also fixes entry layout to use proper record alignment rules (entry
align = max(key_align, value_align), value at aligned offset).
* Refactor map entry layout calculations to use canonical ABI
* Remove unnecessary clone of map pairs during lowering
Val::Map already holds Vec<(Val, Val)> which derefs to &[(Val, Val)],
matching lower_map's signature directly. The intermediate Vec allocation
and deep clone of every key/value pair was redundant.
* Deduplicate map lift logic between HashMap implementations
* Deduplicate list and map sequence translation scaffolding
* Fix cargo fmt formatting issues
* Deduplicate map typecheck logic
* Deduplicate map lowering with linear_lower_map_to_flat and linear_lower_map_to_memory helpers
* Clean up lift_try_map: use drop, move TryHashMap import to module scope
* Fix CI: arbtest overflow and no-std HashMap lift_map
- component_fuzz: use saturating_sub in generate_hashable_key to prevent
underflow when fuel is 0 and Enum variant is chosen
- typed: remove incorrect ? operators in lift_map for hashbrown::HashMap
(with_capacity and insert don't return Result)
* Store map tuple layout in TypeMap
Compute map entry ABI and value offsets once during type building, and reuse that metadata in runtime map lift/lower paths instead of recalculating tuple layout at each call site.
* Refactor map ABI argument passing
Bundle map lift/lower layout and type metadata into a small MapAbi32 helper so map helper calls stay concise without changing behavior.
* Fix CI: enable component_model_map in fuzzing and handle map in arbitrary_val
The fuzzer's component_api oracle was generating map types but the engine
didn't have the map feature enabled, and arbitrary_val had no arm for
Type::Map. Enable component_model_map in the store helper (matching how
component_model_async is forced on) and implement arbitrary value generation
for map types.
---------
Signed-off-by: Yordis Prieto <[email protected]>
show more ...
|