Fix panicking overflow when calculating table sizes (#13244)

Return an error instead of panicking in the same manner that OOM is
handled.

[44.0.0] Merged backports for security advisories (#13007)

* fix(environ): repair unsound StringPool::try_clone()

The 43.0 release introduced a soundness bug in StringPool::try_clone(): the
cloned

[44.0.0] Merged backports for security advisories (#13007)

* fix(environ): repair unsound StringPool::try_clone()

The 43.0 release introduced a soundness bug in StringPool::try_clone(): the
cloned map retains &'static str keys pointing into the original pool's
strings storage. Once the original Linker is dropped those keys dangle.

Cloning a Linker, then dropping the original one, leaves a linker whose
registered imports could no longer be found, causing instantiation to
fail with "unknown import".

Signed-off-by: Flavio Castelli <[email protected]>

* Fix pooling allocator predicate to reset VM permissions

This commit fixes a mistake that was introduced in #9583 where the logic
to reset a linear memory slot in the pooling allocator used the wrong
predicate. Specifically VM permissions must be reset if virtual memory
can be relied on at all, and the preexisting predicate of
`can_elide_bounds_check` was an inaccurate representation of this. The
correct predicate to check is `can_use_virtual_memory`.

* winch: Fix the type of the `table.size` output register

This commit corrects the tagged size of the output of the `table.size`
instruction. Previously this was hardcoded as a 32-bit integer instead
of consulting the table's index type to use the
index-type-sized-register instead.

* winch: Fix a host panic when executing `table.fill`

This commit fixes a possible panic when a Winch-compiled module executes
the `table.fill` instruction. Refactoring in #11254 updated Cranelift
but forgot to update Winch meaning that Winch's indices were still using
the module-level indices instead of the `DefinedTableIndex` space. This
adds some tests and updates Winch's translation to use preexisting
helpers.

* x64: Fix `f64x2.splat` without SSE3

Don't sink a load into `pshufd` which loads 16 bytes, instead force
`put_in_xmm` to ensure only 8 bytes are loaded.

* Properly verify alignment in string transcoding

This commit updates string transcoding between guest modules to properly
verify alignment. Previously alignment was only verified on the first
allocation, not reallocations, which is not spec-compliant. This
additionally fixes a possible host panic when dealing with unaligned
pointers.

* Fix type confusion in AArch64 amode RegScaled folding

* winch: Add add_uextend to perform explicit extension when needed.

This commit fixes an out-of-bounds access caused by the lack zero
extension in the code responsible for calculating the heap address for
loads/stores.

This issue manifests in aarch64 (unlike x64) given that no automatic
extension is performed, resulting in an out-of-bounds access.

An alternative approach is to emit an extend for the index, however
this approach is preferred given that it gives the MacroAssembler
layer better control of how to lower addition, e.g., in aarch64 we can
inline the desired extension in a single instruction.

* winch: Correctly type the result of table.grow

This commit fixes an out-of-bounds access caused by the lack of type
narrowing from the `table.grow` builtin. Without explicit narrowing,
the type is treated as 64-bit value, which could cause issues when
paired with loads/stores.

* Review comments

* Properly handle table index types

Only narrow when dealing with the 64-bit pointer/32-bit tables

* Fix panic with out-of-bounds flags in `Value`

This commit fixes a panic when a component model `Value` is lifted from
a flags value which specifies out-of-bounds bits as 1. This is specified
in the component model to ignore the out-of-bounds bits, which `flags!`
correctly did (and thus `bindgen!`), but `Value` treated out-of-bounds
bits as a panic due to indexing an array.

* Fix bounds checks in FACT's `string_to_compact` method

We need to bounds check the source byte length, not the number of code units.

* Add missing realloc validation in string transcoding

This commit adds a missing validation that a return value of `realloc`
is inbounds during string transcoding. This was accidentally missing on
the transcoding path from `utf8` to `latin1+utf16` which meant that a
nearly-raw pointer could get passed to the host to perform the
transcode.

* winch: Refine zero extension heuristic

This commit refines the zero extension heuristic such that it
unconditionally emits a zero extension when dealing with 32-bit
heaps. This eliminates any ambiguity related to the value of the
memory indices across ISAs.

* Fix failure on 32-bit

* Fix miri test

---------

Signed-off-by: Flavio Castelli <[email protected]>
Co-authored-by: Flavio Castelli <[email protected]>
Co-authored-by: Shun Kashiwa <[email protected]>
Co-authored-by: Saúl Cabrera <[email protected]>
Co-authored-by: Nick Fitzgerald <[email protected]>

show more ...

winch: implement ref.null, ref.is_null, ref.func, and typed select (#12940)

* winch: implement ref.null, ref.is_null, ref.func, and typed select

* add disas tests and ref.func call_indirect coverag

winch: implement ref.null, ref.is_null, ref.func, and typed select (#12940)

* winch: implement ref.null, ref.is_null, ref.func, and typed select

* add disas tests and ref.func call_indirect coverage

* register wasmtime module in fuzz wast_test to fix wast_smoke_test

show more ...

Add missing stack map declaration for `array.new_elem` (#12936)

`translate_array_new_elem` created a GC reference (array ref) via a libcall but
did not call `builder.declare_value_needs_stack_map()`

Add missing stack map declaration for `array.new_elem` (#12936)

`translate_array_new_elem` created a GC reference (array ref) via a libcall but
did not call `builder.declare_value_needs_stack_map()` on the result. This meant
the reference was not included in stack maps at subsequent safepoints, so if a
GC occurred, the reference became stale (leading to use-after-free within the GC
heap sandbox).

show more ...

Add missing missing stack map declaration for `array.new_data` (#12935)

`translate_array_new_data` created a GC reference (array ref) via a libcall but
did not call `builder.declare_value_needs_stac

Add missing missing stack map declaration for `array.new_data` (#12935)

`translate_array_new_data` created a GC reference (array ref) via a libcall but
did not call `builder.declare_value_needs_stack_map()` on the result. This meant
that the reference was not included in stack maps at subsequent safepoints, so
if a GC occurred, the reference became stale (leading to use-after-free bugs
inside the GC heap sandbox).

show more ...

Preserve `try_call[_indirect]` stack maps during lowering (#12934)

* Preserve `try_call[_indirect]` stack maps during lowering

Branch instructions are skipped in the main lowering loop, which means

Preserve `try_call[_indirect]` stack maps during lowering (#12934)

* Preserve `try_call[_indirect]` stack maps during lowering

Branch instructions are skipped in the main lowering loop, which means the stack
map forwarding code is never reached for them. The branch lowering path didn't
forward stack maps either. This was fine because branch instructions couldn't
previously ever be safepoints. However, with the introduction of `try_call` and
`try_call_indirect`, we now have instructions that are both safepoints and
branches.

This caused GC references live across `try_call[_indirect]` instructions to not
be traced during garbage collection, leading to use-after-free within the GC
heap sandbox when the collector swept those untraced-but-still-live objects.

The fix adds stack map forwarding after branch lowering, mirroring the
existing logic for non-branch instructions.

Fixes bytecodealliance/wasmtime#11753.

* update disas test

show more ...

mpk: Fix index used when purging a module in the pooling allocator (#12910)

This commit fixes an issue with the pooling allocator when MPK is
enabled, which is off-by-default at compile time. When a

mpk: Fix index used when purging a module in the pooling allocator (#12910)

This commit fixes an issue with the pooling allocator when MPK is
enabled, which is off-by-default at compile time. When a module is
dropped all remaining images are purged from the pooling allocator, but
the purging logic mistakenly used the wrong kind of index during purging
which led to corruption of the pooling allocator itself. This fixes the
logic and adds regression tests showcasing the issue as well.

show more ...

winch: Fix `memory.atomic.*` with overflowing offsets (#12909)

* winch: Fix `memory.atomic.*` with overflowing offsets

This commit fixes a spec-compliance issue with `memory.atomic.*`
instructions

winch: Fix `memory.atomic.*` with overflowing offsets (#12909)

* winch: Fix `memory.atomic.*` with overflowing offsets

This commit fixes a spec-compliance issue with `memory.atomic.*`
instructions using the Winch compiler. Specifically Winch previously
added the dynamic offset to the static offset when calculating the
effective address of the operation, but this addition was allowed to
overflow. This meant that an operation which should trap would continue
instead. The fix here is to use checked arithmetic at runtime to ensure
that the address computation does not overflow.

* Update test expectations

show more ...

aarch64: Fix miscompile lowering the `extr` instruction (#12907)

This commit fixes a miscompile in the lowering of the `extr` instruction
for the aarch64 backend where one of the shift operands is 0

aarch64: Fix miscompile lowering the `extr` instruction (#12907)

This commit fixes a miscompile in the lowering of the `extr` instruction
for the aarch64 backend where one of the shift operands is 0. In this
edge case the generated `extr` instruction did not match the input CLIF
semantics, calculating a different value. The fix here is to only use
the `extr` instruction when both immediates are larger than 0.

show more ...

winch: Fix `memory.size` on maximally-sized 32-bit memories (#12908)

* winch: Fix `memory.size` on maximally-sized 32-bit memories

This commit fixes a minor issue in the Winch backend where when a

winch: Fix `memory.size` on maximally-sized 32-bit memories (#12908)

* winch: Fix `memory.size` on maximally-sized 32-bit memories

This commit fixes a minor issue in the Winch backend where when a 32-bit
linear memory had the full 4GiB size the `memory.size` instruction would
return 0 instead of returning `0x1_0000`. This is due to the shift to
create the number of pages being done with the index type of the linear
memory instead of the pointer size of the machine.

* Update test expectations

show more ...

Verify alignment of returned component-model strings (#12897)

* Verify alignment of returned component-model strings

The lifting code erroneously forgot to check for this. There's no actual
consequ

Verify alignment of returned component-model strings (#12897)

* Verify alignment of returned component-model strings

The lifting code erroneously forgot to check for this. There's no actual
consequence to this in Wasmtime per-se, but it's required in the
component model spec to trap, so a trap is added here.

* Fix tests

* Optimize alignment check

* Fix build

show more ...

winch(aarch64): Improve addressing modes (#12708)

Prior to this commit, Winch's `Address` representation relied on the
general `(reg, offset)` form for offset-based addressing, leaving the
materiali

winch(aarch64): Improve addressing modes (#12708)

Prior to this commit, Winch's `Address` representation relied on the
general `(reg, offset)` form for offset-based addressing, leaving the
materialization of the addressing mode to Cranelift. This approach led
to the following bug found by the fuzzer:

When offsets cannot be encoded as a 9-bit signed immediate offset or a
12-bit unsigned immediate offset with scaling, the offset must be
loaded into a register and the addressing mode is transformed to its
`(reg, reg)` form. Cranelift's addressing mode materialization currently
uses `x16` as a scratch register to load the offset; even though
both Cranelift and Winch use `x16` as a scratch register, its usage is
not in sync, therefore clobbers can happen.

This commit improves addressing modes by requiring early
materialization of addressing modes into their respective Cranelift
variants.

show more ...

Fix table64 initialization when bulk memory is disabled (#12894)

* Fix table64 initialization when bulk memory is disabled

This commit fixes a panic in the host during instantiation when the
`bulk_

Fix table64 initialization when bulk memory is disabled (#12894)

* Fix table64 initialization when bulk memory is disabled

This commit fixes a panic in the host during instantiation when the
`bulk_memory` wasm feature is disabled. In this mode the initialization
of tables/memories is slightly different and a refactoring for 64-bit
support wasn't applied to this code path, meaning that it resulted in a
panic instead of properly handling 64-bit tables.

* Fix clippy

show more ...

Fix bounds check for `error-context.debug-message` (#12879)

* Fix bounds check for `error-context.debug-message`

This fixes a possible subsequent panic when lowering the message itself.

* Review c

Fix bounds check for `error-context.debug-message` (#12879)

* Fix bounds check for `error-context.debug-message`

This fixes a possible subsequent panic when lowering the message itself.

* Review comments

show more ...

Fix a stacked borrows violation in futures/streams copy (#12872)

* Fix a stacked borrows violation in futures/streams copy

This commit fixes an issue in the copy implementation for
futures/streams

Fix a stacked borrows violation in futures/streams copy (#12872)

* Fix a stacked borrows violation in futures/streams copy

This commit fixes an issue in the copy implementation for
futures/streams related to component-model-async. Specifically the added
tests here tripped an error in Miri which is related to intra-component
copies and stacked borrows. This refactoring ends up using `copy_within`
for the intra-component case and `copy_to_nonoverlapping` for the
inter-component case to resolve this issue. This commit additionally
refactors the validation/checks to happen in one location instead of in
a few to ensure that all validation is done up-front in a shared manner.

* Fix CI

* Fix expected error message

* Review comments

show more ...

Fix state of futures/streams after cancellation (#12881)

* Fix state of futures/streams after cancellation

This fixes two related but distinct issues with respect to delivering
events to stream/fut

Fix state of futures/streams after cancellation (#12881)

* Fix state of futures/streams after cancellation

This fixes two related but distinct issues with respect to delivering
events to stream/future handles. First when delivering an event to a
future or a stream the shared code is now more unified into one path.
This fixes an issue with futures where they would always have `done`
flagged as `false` accidentally. This then fixes an additional issue
where this `on_delivery` function wasn't invoked when futures/streams
had their operations cancelled.

* Fix CI

show more ...

Fix double read/writes on stream/future handles (#12873)

* Fix double read/writes on stream/future handles

This should result in a first-class trap, not a bug.

* Fix CI

Adjust behavior of 4gb memories with custom page sizes (#12884)

* Adjust behavior of 4gb memories with custom page sizes

This commit adjust what happens when a linear memory grows up to 4gb
large w

Adjust behavior of 4gb memories with custom page sizes (#12884)

* Adjust behavior of 4gb memories with custom page sizes

This commit adjust what happens when a linear memory grows up to 4gb
large when custom page sizes are used. This is an open question in the
upstream proposal at WebAssembly/custom-page-sizes#45 but without any
special handling a return value of -1 is ambiguous if it succeeded or
failed. For now eagerly trap memory operations reaching these conditions
while the upstream specification question is resolved.

* Fix CI

* Debug CI failure

prtest:full

* Fix 32-bit platforms

show more ...

Fix error message for out-of-bounds variant discriminants (#12885)

Fixes a minor mistake when loading a `Val` from memory with an
out-of-bounds discriminant.

Fix two off-by-one correctness issues in string transcoding (#12886)

The first issue fixes here is that the maximum string byte length was
one byte larger than the spec defines (`1<<31` instead of `

Fix two off-by-one correctness issues in string transcoding (#12886)

The first issue fixes here is that the maximum string byte length was
one byte larger than the spec defines (`1<<31` instead of `(1<<31)-1`).
The second issue is that in the comparison against the maximum byte
length `>=` was used where `>` should have been used. A test has been
added which exercises these two cases.

show more ...

Add `bulk_memory` to wast configuration (#12883)

Allows enabling/disabling this wasm proposal on a per-test basis.

feat(style,doc): added typos-cli workspace configuration (#12827)

* init config values

* more manual changes

* typos write

* revert certain changes

* misused, tightened up hex encoding

fix: correct various typos (#12807)

Signed-off-by: Ho Kim <[email protected]>

cm-async: Fix cancelling a completed host task (#12797)

Incorrect behavior on Wasmtime's part led to erroneously raising a trap
in the guest about the terminal status of a task being delivered
alrea

cm-async: Fix cancelling a completed host task (#12797)

Incorrect behavior on Wasmtime's part led to erroneously raising a trap
in the guest about the terminal status of a task being delivered
already. This commit refactors some internals to ensure that cancelling
a completed host task is not a failure, it instead just returns that the
host task is indeed completed.

show more ...

Consume hostcall fuel when buffering stream data in the host (#12767)

For guest-to-guest communication stream reads/writes rendezvousing
together will currently copy data through `Val`. This is expe

Consume hostcall fuel when buffering stream data in the host (#12767)

For guest-to-guest communication stream reads/writes rendezvousing
together will currently copy data through `Val`. This is expected to
become more optimized in the future, but for now this needs to consume
the concept of "hostcall fuel" introduced in #12652 to ensure that the
guest can't exhaust memory in the host. This additionally tweaks some
hostcall fuel calculations to more accurately reflect the size of values
on the host, notably by using `size_of::<Thing>()` on the host rather
than the size in the guest.

Closes #12674

show more ...