[44.0.0] Merged backports for security advisories (#13007)

* fix(environ): repair unsound StringPool::try_clone()

The 43.0 release introduced a soundness bug in StringPool::try_clone(): the
cloned

[44.0.0] Merged backports for security advisories (#13007)

* fix(environ): repair unsound StringPool::try_clone()

The 43.0 release introduced a soundness bug in StringPool::try_clone(): the
cloned map retains &'static str keys pointing into the original pool's
strings storage. Once the original Linker is dropped those keys dangle.

Cloning a Linker, then dropping the original one, leaves a linker whose
registered imports could no longer be found, causing instantiation to
fail with "unknown import".

Signed-off-by: Flavio Castelli <[email protected]>

* Fix pooling allocator predicate to reset VM permissions

This commit fixes a mistake that was introduced in #9583 where the logic
to reset a linear memory slot in the pooling allocator used the wrong
predicate. Specifically VM permissions must be reset if virtual memory
can be relied on at all, and the preexisting predicate of
`can_elide_bounds_check` was an inaccurate representation of this. The
correct predicate to check is `can_use_virtual_memory`.

* winch: Fix the type of the `table.size` output register

This commit corrects the tagged size of the output of the `table.size`
instruction. Previously this was hardcoded as a 32-bit integer instead
of consulting the table's index type to use the
index-type-sized-register instead.

* winch: Fix a host panic when executing `table.fill`

This commit fixes a possible panic when a Winch-compiled module executes
the `table.fill` instruction. Refactoring in #11254 updated Cranelift
but forgot to update Winch meaning that Winch's indices were still using
the module-level indices instead of the `DefinedTableIndex` space. This
adds some tests and updates Winch's translation to use preexisting
helpers.

* x64: Fix `f64x2.splat` without SSE3

Don't sink a load into `pshufd` which loads 16 bytes, instead force
`put_in_xmm` to ensure only 8 bytes are loaded.

* Properly verify alignment in string transcoding

This commit updates string transcoding between guest modules to properly
verify alignment. Previously alignment was only verified on the first
allocation, not reallocations, which is not spec-compliant. This
additionally fixes a possible host panic when dealing with unaligned
pointers.

* Fix type confusion in AArch64 amode RegScaled folding

* winch: Add add_uextend to perform explicit extension when needed.

This commit fixes an out-of-bounds access caused by the lack zero
extension in the code responsible for calculating the heap address for
loads/stores.

This issue manifests in aarch64 (unlike x64) given that no automatic
extension is performed, resulting in an out-of-bounds access.

An alternative approach is to emit an extend for the index, however
this approach is preferred given that it gives the MacroAssembler
layer better control of how to lower addition, e.g., in aarch64 we can
inline the desired extension in a single instruction.

* winch: Correctly type the result of table.grow

This commit fixes an out-of-bounds access caused by the lack of type
narrowing from the `table.grow` builtin. Without explicit narrowing,
the type is treated as 64-bit value, which could cause issues when
paired with loads/stores.

* Review comments

* Properly handle table index types

Only narrow when dealing with the 64-bit pointer/32-bit tables

* Fix panic with out-of-bounds flags in `Value`

This commit fixes a panic when a component model `Value` is lifted from
a flags value which specifies out-of-bounds bits as 1. This is specified
in the component model to ignore the out-of-bounds bits, which `flags!`
correctly did (and thus `bindgen!`), but `Value` treated out-of-bounds
bits as a panic due to indexing an array.

* Fix bounds checks in FACT's `string_to_compact` method

We need to bounds check the source byte length, not the number of code units.

* Add missing realloc validation in string transcoding

This commit adds a missing validation that a return value of `realloc`
is inbounds during string transcoding. This was accidentally missing on
the transcoding path from `utf8` to `latin1+utf16` which meant that a
nearly-raw pointer could get passed to the host to perform the
transcode.

* winch: Refine zero extension heuristic

This commit refines the zero extension heuristic such that it
unconditionally emits a zero extension when dealing with 32-bit
heaps. This eliminates any ambiguity related to the value of the
memory indices across ISAs.

* Fix failure on 32-bit

* Fix miri test

---------

Signed-off-by: Flavio Castelli <[email protected]>
Co-authored-by: Flavio Castelli <[email protected]>
Co-authored-by: Shun Kashiwa <[email protected]>
Co-authored-by: Saúl Cabrera <[email protected]>
Co-authored-by: Nick Fitzgerald <[email protected]>

show more ...

winch: implement ref.null, ref.is_null, ref.func, and typed select (#12940)

* winch: implement ref.null, ref.is_null, ref.func, and typed select

* add disas tests and ref.func call_indirect coverag

winch: implement ref.null, ref.is_null, ref.func, and typed select (#12940)

* winch: implement ref.null, ref.is_null, ref.func, and typed select

* add disas tests and ref.func call_indirect coverage

* register wasmtime module in fuzz wast_test to fix wast_smoke_test

show more ...

Debugging: add debugger support for `wasmtime serve`. (#12859)

This adopts a simple solution to #12776: it takes the "instance reuse"
paradigm to the extreme, instantiating exactly one instance and

Debugging: add debugger support for `wasmtime serve`. (#12859)

This adopts a simple solution to #12776: it takes the "instance reuse"
paradigm to the extreme, instantiating exactly one instance and
serializing all requests into that one instance. This allows the
debugger component to operate on one `Store`, setting breakpoint state
and presenting its execution to the attached debugger as a single
program execution and minimizing impedance mismatches.

This also adds an integration test that runs an existing wasi-http
test component under the debugger.

show more ...

mpk: Fix index used when purging a module in the pooling allocator (#12910)

This commit fixes an issue with the pooling allocator when MPK is
enabled, which is off-by-default at compile time. When a

mpk: Fix index used when purging a module in the pooling allocator (#12910)

This commit fixes an issue with the pooling allocator when MPK is
enabled, which is off-by-default at compile time. When a module is
dropped all remaining images are purged from the pooling allocator, but
the purging logic mistakenly used the wrong kind of index during purging
which led to corruption of the pooling allocator itself. This fixes the
logic and adds regression tests showcasing the issue as well.

show more ...

Several fixes to debugging infrastructure: component vs. module PCs and gdbstub wasm module names. (#12901)

* Debugging: fix module-relative vs component-relative PCs and unique library names.

Two

Several fixes to debugging infrastructure: component vs. module PCs and gdbstub wasm module names. (#12901)

* Debugging: fix module-relative vs component-relative PCs and unique library names.

Two bugfixes for guest debugging with components:

1. Convert component-relative source locations to module-relative PCs
in the frame table. The guest-debug API presents a core-Wasm view
where components are deconstructed into individual modules, so all
PCs must be module-relative. This adds a `wasm_module_offset` field
to `ModuleTranslation` and `FuncEnvironment`, set during component
translation, and subtracts it in `debug_tags()`.

2. Give unique names to "library" entries in the gdbstub XML response.
LLDB's DynamicLoader deduplicates by name, so using "wasm" for all
modules caused only the first to be loaded.

* Debugging: add ModulePC and ComponentPC newtypes for Wasm PC offsets.

Introduce `ModulePC` (module-relative) and `ComponentPC`
(component-relative) newtype wrappers around u32 Wasm bytecode
offsets. These replace raw u32 values throughout the frame table,
breakpoint, and debug systems to prevent confusion between the two
offset spaces.

* Debugging: add regression test for component module-relative PCs.

show more ...

Fix overlap assertions in string transcoding (#12893)

Fixes an off-by-one assertion which is possible to happen when linear
memories are directly adjacent to each other. While an esoteric
situation,

Fix overlap assertions in string transcoding (#12893)

Fixes an off-by-one assertion which is possible to happen when linear
memories are directly adjacent to each other. While an esoteric
situation, it's technically possible as the added test shows.

Closes #12678

show more ...

Handle OOM in the rest of Wasmtime's non-component, -async, -compilation APIs (#12858)

* Handle OOM in more places in the public API

A bunch of random places:

* Add: `Trap::try_new` to handle OOM

Handle OOM in the rest of Wasmtime's non-component, -async, -compilation APIs (#12858)

* Handle OOM in more places in the public API

A bunch of random places:

* Add: `Trap::try_new` to handle OOM while creating traps
* Use: `TryVec` inside `Func::call_impl_do_call` and `wasm_val_raw_storage` to
hold the args and rets
* Add: `Instance::try_exports` for iterating over an instance's exports while
handling OOM
* `Linker:try_get`, like `Linker::get` but handling OOM
* `Linker:try_get_by_import`, like `Linker::get_by_import` but handling OOM
* Use `try_new` to box things in `SharedMemory::new`
* Use `TryVec` instead of `Vec` in our dynamic tables

* Add OOM tests for most of Wasmtime's public API

Excludes component-, async-, and compilation-related APIs.

* address review feedback

* fix test compilation

* fix c-api

show more ...

Fix a panic with a massive `max_wasm_stack` configured (#12869)

* Fix a panic with a massive `max_wasm_stack` configured

This commit fixes a panic through a `checked_add(...).unwrap()` which
can ha

Fix a panic with a massive `max_wasm_stack` configured (#12869)

* Fix a panic with a massive `max_wasm_stack` configured

This commit fixes a panic through a `checked_add(...).unwrap()` which
can happen when `Config::max_wasm_stack` is configured to be a very
large value. This is a mostly benign panic as it's unlikely this is
configured much in the wild, but nevertheless seems like a good issues
to fix regardless.

* Fix an overflow/OOM panic in pulley

prtest:full

* Fix CI

* Another CI fix

* Fix test on 32-bit

* Fix miri test

show more ...

Fix a stacked borrows violation in futures/streams copy (#12872)

* Fix a stacked borrows violation in futures/streams copy

This commit fixes an issue in the copy implementation for
futures/streams

Fix a stacked borrows violation in futures/streams copy (#12872)

* Fix a stacked borrows violation in futures/streams copy

This commit fixes an issue in the copy implementation for
futures/streams related to component-model-async. Specifically the added
tests here tripped an error in Miri which is related to intra-component
copies and stacked borrows. This refactoring ends up using `copy_within`
for the intra-component case and `copy_to_nonoverlapping` for the
inter-component case to resolve this issue. This commit additionally
refactors the validation/checks to happen in one location instead of in
a few to ensure that all validation is done up-front in a shared manner.

* Fix CI

* Fix expected error message

* Review comments

show more ...

Adjust behavior of 4gb memories with custom page sizes (#12884)

* Adjust behavior of 4gb memories with custom page sizes

This commit adjust what happens when a linear memory grows up to 4gb
large w

Adjust behavior of 4gb memories with custom page sizes (#12884)

* Adjust behavior of 4gb memories with custom page sizes

This commit adjust what happens when a linear memory grows up to 4gb
large when custom page sizes are used. This is an open question in the
upstream proposal at WebAssembly/custom-page-sizes#45 but without any
special handling a return value of -1 is ambiguous if it succeeded or
failed. For now eagerly trap memory operations reaching these conditions
while the upstream specification question is resolved.

* Fix CI

* Debug CI failure

prtest:full

* Fix 32-bit platforms

show more ...

Fix a panic in `Bytes{,Mut}` `StreamProducer` impls (#12878)

This commit fixes the logic of these `impl`s to match the `Vec`-style
blocks to relinquish the entire buffer to Wasmtime immediately. Thi

Fix a panic in `Bytes{,Mut}` `StreamProducer` impls (#12878)

This commit fixes the logic of these `impl`s to match the `Vec`-style
blocks to relinquish the entire buffer to Wasmtime immediately. This
fixes an issue where `split_off` is called with too large a value which
can panic.

show more ...

Fix a copy/paste typo in `StreamAny` (#12871)

When closing, close a stream, not a future. Fixes the test added here as
well.

Fix `select` missing stack map declarations for GC refs (#12862)

* Fix `select` missing stack map declarations for GC refs

The `select` and typed `select` Wasm operators create new SSA values in
Cr

Fix `select` missing stack map declarations for GC refs (#12862)

* Fix `select` missing stack map declarations for GC refs

The `select` and typed `select` Wasm operators create new SSA values in
Cranelift but were not calling `declare_value_needs_stack_map` on the result
when the operand type is a GC reference. This meant the result, when kept on the
Wasm operand stack (not stored in a local variable), would not appear in stack
maps at subsequent safepoints.

If a GC collection occurred at such a safepoint, the collector would not see the
`select`'s result as a live GC root and could free the referenced object,
leading to use-after-free.

The fix checks `select`'s operand types for reference types and declares the
result as requiring inclusion in stack maps when needed.

* address review feedback and make needs-stack-maps decision more precise

* fix assertion

show more ...

Add `bulk_memory` to wast configuration (#12883)

Allows enabling/disabling this wasm proposal on a per-test basis.

Debugging: add integration test with LLDB and some minor tweaks. (#12856)

This PR adds:

- An integration-test that runs LLDB against the Wasmtime CLI to
verify basic debugging functionality, simi

Debugging: add integration test with LLDB and some minor tweaks. (#12856)

This PR adds:

- An integration-test that runs LLDB against the Wasmtime CLI to
verify basic debugging functionality, similar to the existing
native-debug tests.

- A CI job that runs the above in CI.

- Some minor tweaks to the gdbstub debugger design:
- Rather than the initial single-step to get to the first Wasm
instruction where module(s) will be instantiated into the store
and visible to the debugger, we pre-register modules with the
store eagerly. This avoids the slightly hacky flow and also is a
preparation step for `wasmtime serve` debugging, where we can't
single-step into execution eagerly (because execution doesn't
start at all until an HTTP request arrives).
- Add a separate message-printing path for "debugger info messages",
allowing us to print the "debugger is listening on <PORT>" message
without inheriting stderr for the whole debugger component
environment. This message is necessary for the above integration
test (it parses the message to determine when the debuggee is ready).

show more ...

fix: correct various typos (#12807)

Signed-off-by: Ho Kim <[email protected]>

Debugging: add debug-tags to instrumented trap sites so we actually get PCs on traps. (#12802)

This was not exposed earlier by (i) lack of handling of trap events in
the initial version of the gdbst

Debugging: add debug-tags to instrumented trap sites so we actually get PCs on traps. (#12802)

This was not exposed earlier by (i) lack of handling of trap events in
the initial version of the gdbstub component in #12771, and (ii) lack
of asserting some value for the PC on the top frame in the debug-event
test for traps. We got the PC for the last opcode in the function body
previously because, with no debug tags on the trapping path that calls
raise() (sunk to the bottom of the machine code body as cold code), we
scanned backward for the last tag metadata and found that
instead. Adding metadata according to the current source location when
emitting traps fixes this for all trapping events.

show more ...

Debugging: allow breakpoints to be set at "function start" by slipping forward to first opcode. (#12791)

LLDB, when instructed to `break main`, looks at the DWARF metadata for
`main` and finds its P

Debugging: allow breakpoints to be set at "function start" by slipping forward to first opcode. (#12791)

LLDB, when instructed to `break main`, looks at the DWARF metadata for
`main` and finds its PC range, then sets a breakpoint at the first
PC. This is reasonable behavior for native ISAs! That PC better be a
real instruction!

On Wasm, however, (i) toolchains typically emit the PC range as
*including* the *locals count*, a leb128 value that precedes the first
opcode and any types of locals; (ii) our gdbstub component that
bridges LLDB to our debug APIs (#12771) only supports *exact* PCs for
breakpoints, so when presented with a PC that does not actually point
to an opcode, setting the breakpoint is effectively a no-op. There
will always be a difference of at least 1 byte between the
start-of-function offset and first-opcode offset (for a leb128 of `0`
for no locals), so a breakpoint "on" a function will never work.

I initially prototyped a fix that adds a sequence point at the start
of every function (which, again, is *guaranteed* to be distinct from
the first opcode), and the branch is [here], but I didn't like the
developer experience: this meant that when a breakpoint at a function
start fired, LLDB had a weird interstitial state where no line-number
applied.

The behavior that would be closer in line with "native" debug
expectations is that we add a bit of fuzzy-ish matching: setting a
breakpoint at function start should break at the first opcode, even if
that's a few (or many) bytes later. There are two options here:
special-case function start, or generally change the semantics of our
breakpoint API so that "add breakpoint at `pc`" means "add breakpoint
at next opcode at or after `pc`". I opted for the latter in this PR
because it's more consistent.

The logic is a little subtle because we're effectively defining an
n-to-1 mapping with this "snap-to-next" behavior, so we have to
refcount each breakpoint (consider setting a breakpoint at function
start *and* at the first opcode, then deleting them, one at a time). I
believe the result is self-consistent, even if a little more
complicated now. And, importantly, with #12771 on top of this change,
it produces the expected behavior for the (very simple!) debug script
"`b main`; `continue`".

[here]: https://github.com/cfallin/wasmtime/tree/breakpoint-at-func-start

show more ...

wasip3: Limit randomness instead of trapping (#12794)

This updates the behavior of the randomness-generating interfaces in
WASIp3 to account for recent spec changes, notably the ability for the
gues

wasip3: Limit randomness instead of trapping (#12794)

This updates the behavior of the randomness-generating interfaces in
WASIp3 to account for recent spec changes, notably the ability for the
guest to receive less random bytes than requested to limit allocations
the host is forced to do.

cc WebAssembly/WASI#901

show more ...

WASIP3 HTTP return error for TooManyFields/TotalSizeTooBig (#12788)

* WASIP3 HTTP return error for TooManyFields/TotalSizeTooBig

Return new error from

* WASIP3 HTTP split tests between p2/p3

p2 c

WASIP3 HTTP return error for TooManyFields/TotalSizeTooBig (#12788)

* WASIP3 HTTP return error for TooManyFields/TotalSizeTooBig

Return new error from

* WASIP3 HTTP split tests between p2/p3

p2 cases unchanged (they trap before break is reached).

p3 cases assert the guest exited successfully and
that it printed "error received", confirming the limit was actually enforced.

show more ...

Include core instance sizes in component_instance_size limit (#12772)

* Include core instance sizes in component_instance_size limit

There exist several knobs for limiting the memory that might be

Include core instance sizes in component_instance_size limit (#12772)

* Include core instance sizes in component_instance_size limit

There exist several knobs for limiting the memory that might be consumed
for metadata for components. For core module instances within a
component, the two that previously existed to control metadata
allocations have been:
- A: max_core_instances_per_component
- B: component_instance_size

These allow for an embedder to set an upper bound on memory used by a
component's instances to A * B. This value could be quite large for
some systems and it would be nice to be able to set a cap on the total
memory that might be used for metadata across all instances while still
allowing for a greater number of instances with the potential for a
subset of those instances to be relatively large.

To allow for aggregate control over memory used within the runtime
for componenets, the existing `max_component_instance_size` limit
is extended to consider both the `VMComponentCtx` size as well as
the aggregate size of all core instances in the component.

* Fix err msg checks for component_instance_size_limit test

* Miri ignore component_core_instances_aggregate_size

show more ...

Debugging: add the debug-main world. (#12756)

* Debugging: add the debug-main world.

This PR "draws the rest of the owl" for the debug-main
world (bytecodealliance/rfcs#45). This includes a WIT wor

Debugging: add the debug-main world. (#12756)

* Debugging: add the debug-main world.

This PR "draws the rest of the owl" for the debug-main
world (bytecodealliance/rfcs#45). This includes a WIT world that hosts
debug components that have access to "host debug powers" via a
debugging API, and the ability to load such a debug-component and give
it control of the main program as a debuggee when using `wasmtime
run`.

The WIT is namespaced to `bytecodealliance:wasmtime` and is slightly
aspirational in places: for example, the host does not yet implement
injection of early return values or exception-throws. I intend to fill
out a series of TODO issues once this all lands to track followup
("post-MVP") work.

This PR does not include any debug components. I separately have a
gdbstub component, with which I tested and co-developed this host-side
implementation. My plan is to land it in a followup PR as a component
that will be embedded in/shipped with the Wasmtime CLI and available
under an easy-to-use CLI option. Once we have that gdbstub component,
we can also implement end-to-end integration tests that boot up LLDB
and run through an expected interaction. (Separately, those
integration tests will require a release of wasi-sdk to ship an LLDB
binary that we can use.) As such, there are no real tests in this PR:
interesting behaviors only really occur with a full end-to-end flow.

The integration with the CLI is a little awkward (we internally build
another `wasmtime run` command that invokes the debug component, and
tie it together with the debuggee via a special `invoke_debugger` API;
this seemed less bad than reworking all of the WASI setup to be more
reusable). Happy to take more ideas here.

* Review feedback.

* Review feedback.

* Review feedback: update vendor-wit.sh.

* Review feedback: -Ddebugger-arg= -> -Darg=.

* Review feedback.

* Review feedback.

* Review feedback: factor host.rs into several submodules.

* Review feedback: rename Debugger to Debuggee on host side.

* Review feedback: split inherit_stdin_stdout, and add corresponding options for the debug component.

* Review feedback.

* Review feedback.

* Add simple debug-component tests.

* Add wasm32-wasip2 target in a few places in CI

* Cargo vets for wstd dependency.

* Add wasm32-wasip2 in more places

* fix debug-component test dependence on componentization byte offsets

* Review feedback.

* Fix cancel-safety of EventFuture.

* Fix: Interrupted events should only occur after interrupt(), not on every epoch yield.

* Review feedback.

* Review feedback: strip down WASI imports in debugger world.

* fold debugger test component back into wasip1 + adapter test artifact compilation flow

show more ...

Enable limiting wasip3 resource limits (#12761)

* Enable limiting wasip3 resource limits

This commit adds a new `Store::concurrent_resource_table` method which
enables getting a handle to the under

Enable limiting wasip3 resource limits (#12761)

* Enable limiting wasip3 resource limits

This commit adds a new `Store::concurrent_resource_table` method which
enables getting a handle to the underlying `ResourceTable` used by the
concurrent implementation of component-model-async. This can in turn be
used to set the max capacity on the table and limit the guest usage of
the table.

Closes #11552

* Adjust features

* Fix imports

show more ...

Refactor `wasi:http` headers' host representation (#12754)

* Refactor `wasi:http` headers' host representation

This commit is a follow-on/extension of #12748 and extends the changes
made for WASIp2

Refactor `wasi:http` headers' host representation (#12754)

* Refactor `wasi:http` headers' host representation

This commit is a follow-on/extension of #12748 and extends the changes
made for WASIp2 headers in #12652 to the WASIp3 implementation as well.
This is done through a number of refactorings to make the WASIp2 and
WASIp3 implementations more similar in terms of how they represent
headers. Changes here are:

* `FieldMap` now has its own dedicated module at the crate root instead
of intermingling with other WASIp2 types.
* `FieldMap` is now internally-`Arc`'d and is cheaply clonable.
`FieldMap` itself now tracks whether it's mutable or immutable (WASI
semantics) and doesn't need different wrappers in WASIp2 and WASIp3.
* Creation of an immutable `FieldMap` can be done without needing a size
limit. Flagging a `FieldMap` as mutable, however, requires a size limit.
* `FieldMap::set` was added to be a bit more efficient w.r.t. clones.
* `FieldMapError` is a new error type that covers all of the possible
error modes of operating with a `FieldMap`. Conversions from this to
WASIp{2,3} `header-error` types are now implemented as well.
* WASIp2 now flags `header-error` as a trappable-error-type, allowing
the use of `?` in implementing header functions (like WASIp3).
* Much of WASIp2's header implementation was refactored with `?`, moving
methods around, shuffling where headers are made vs `FieldMap`, some
minor idioms, etc.
* WASIp3 no longer uses `MaybeMutable` for headers and instead uses
`FieldMap` directly.

cc #12674

* Clippy warnings

show more ...

Debugging: PC in a frame at a callsite should be the return address, not the call. (#12750)

* Debugging: PC in a frame at a callsite should be the return address, not the call.

In working out why a

Debugging: PC in a frame at a callsite should be the return address, not the call. (#12750)

* Debugging: PC in a frame at a callsite should be the return address, not the call.

In working out why a `finish` command in
LLDB-attached-to-Wasmtime-via-gdbstub wasn't working, I discovered that
our current debugging APIs, when presenting info from a frame suspended
at a callsite up the stack, present the current PC as *at* the call
instruction, rather than *past it* (at the return address). The latter
is conventional on all real ISAs, and is hence what the debugger
expects.

This PR makes the most straightforward fix: the debug tuple attached to
the call, and hence the metadata read out by the debug frame walker, now
encodes the PC of the next opcode. This is sufficient to fix `finish`
within LLDB.

An alternative I considered, and prototyped, is also worth mentioning:
one might see the argument for allowing a debugger to see the callsite
that invoked the next frame, and separately, see the return address
(i.e., both pieces of information are useful). In [an alternative
branch], there is a new table in the debug frame info metadata giving
the size of each callsite, so the debug frame-handle API can present a
`get-return-address` accessor on a `frame` resource alongside `get-pc`.
Ultimately I opted not to go with this because it has more overhead and
complexity and a *concrete* use-case wasn't forthcoming to me, but I'm
happy to reconsider if someone wants that instead.

[an alternative branch]: https://github.com/cfallin/wasmtime/tree/debugger-return-address-separate

* Fix return PC in Pulley test.

* Fix disas test.

show more ...