Changes in disas

39e910be - [44.0.0] Merged backports for security advisories (#13007)

Thu, 09 Apr 2026 17:00:00 +0000

[44.0.0] Merged backports for security advisories (#13007)* fix(environ): repair unsound StringPool::try_clone()The 43.0 release introduced a soundness bug in StringPool::try_clone(): thecloned map retains &'static str keys pointing into the original pool'sstrings storage. Once the original Linker is dropped those keys dangle.Cloning a Linker, then dropping the original one, leaves a linker whoseregistered imports could no longer be found, causing instantiation tofail with "unknown import".Signed-off-by: Flavio Castelli * Fix pooling allocator predicate to reset VM permissionsThis commit fixes a mistake that was introduced in #9583 where the logicto reset a linear memory slot in the pooling allocator used the wrongpredicate. Specifically VM permissions must be reset if virtual memorycan be relied on at all, and the preexisting predicate of`can_elide_bounds_check` was an inaccurate representation of this. Thecorrect predicate to check is `can_use_virtual_memory`.* winch: Fix the type of the `table.size` output registerThis commit corrects the tagged size of the output of the `table.size`instruction. Previously this was hardcoded as a 32-bit integer insteadof consulting the table's index type to use theindex-type-sized-register instead.* winch: Fix a host panic when executing `table.fill`This commit fixes a possible panic when a Winch-compiled module executesthe `table.fill` instruction. Refactoring in #11254 updated Craneliftbut forgot to update Winch meaning that Winch's indices were still usingthe module-level indices instead of the `DefinedTableIndex` space. Thisadds some tests and updates Winch's translation to use preexistinghelpers.* x64: Fix `f64x2.splat` without SSE3Don't sink a load into `pshufd` which loads 16 bytes, instead force`put_in_xmm` to ensure only 8 bytes are loaded.* Properly verify alignment in string transcodingThis commit updates string transcoding between guest modules to properlyverify alignment. Previously alignment was only verified on the firstallocation, not reallocations, which is not spec-compliant. Thisadditionally fixes a possible host panic when dealing with unalignedpointers.* Fix type confusion in AArch64 amode RegScaled folding* winch: Add add_uextend to perform explicit extension when needed.This commit fixes an out-of-bounds access caused by the lack zeroextension in the code responsible for calculating the heap address forloads/stores.This issue manifests in aarch64 (unlike x64) given that no automaticextension is performed, resulting in an out-of-bounds access.An alternative approach is to emit an extend for the index, howeverthis approach is preferred given that it gives the MacroAssemblerlayer better control of how to lower addition, e.g., in aarch64 we caninline the desired extension in a single instruction.* winch: Correctly type the result of table.growThis commit fixes an out-of-bounds access caused by the lack of typenarrowing from the `table.grow` builtin. Without explicit narrowing,the type is treated as 64-bit value, which could cause issues whenpaired with loads/stores.* Review comments* Properly handle table index typesOnly narrow when dealing with the 64-bit pointer/32-bit tables* Fix panic with out-of-bounds flags in `Value`This commit fixes a panic when a component model `Value` is lifted froma flags value which specifies out-of-bounds bits as 1. This is specifiedin the component model to ignore the out-of-bounds bits, which `flags!`correctly did (and thus `bindgen!`), but `Value` treated out-of-boundsbits as a panic due to indexing an array.* Fix bounds checks in FACT's `string_to_compact` methodWe need to bounds check the source byte length, not the number of code units.* Add missing realloc validation in string transcodingThis commit adds a missing validation that a return value of `realloc`is inbounds during string transcoding. This was accidentally missing onthe transcoding path from `utf8` to `latin1+utf16` which meant that anearly-raw pointer could get passed to the host to perform thetranscode.* winch: Refine zero extension heuristicThis commit refines the zero extension heuristic such that itunconditionally emits a zero extension when dealing with 32-bitheaps. This eliminates any ambiguity related to the value of thememory indices across ISAs.* Fix failure on 32-bit* Fix miri test---------Signed-off-by: Flavio Castelli Co-authored-by: Flavio Castelli Co-authored-by: Shun Kashiwa Co-authored-by: Saúl Cabrera Co-authored-by: Nick Fitzgerald List of files: /wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/add/i64_atomic_rmw16_addu.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/add/i64_atomic_rmw_add.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/and/i32_atomic_rmw16_andu.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/and/i64_atomic_rmw16_andu.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/and/i64_atomic_rmw_and.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/cmpxchg/i32_atomic_rmw16_cmpxchgu.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/cmpxchg/i64_atomic_rmw16_cmpxchgu.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/cmpxchg/i64_atomic_rmw32_cmpxchgu.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/cmpxchg/i64_atomic_rmw_cmpxchg.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/or/i32_atomic_rmw16_oru.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/or/i64_atomic_rmw16_oru.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/xchg/i64_atomic_rmw16_xchgu.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/xchg/i64_atomic_rmw_xchg.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/xor/i32_atomic_rmw16_xoru.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/xor/i64_atomic_rmw16_xoru.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/rmw/xor/i64_atomic_rmw_xor.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/store/i32_atomic_store16.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/store/i64_atomic_store.wat/wasmtime-44.0.1/tests/disas/winch/x64/atomic/store/i64_atomic_store16.wat

df579907 - Cranelift: upgrade to regalloc2 0.14.0 and use static/constant `MachineEnv`s. (#12596)

Sun, 15 Feb 2026 01:00:00 +0000

Cranelift: upgrade to regalloc2 0.14.0 and use static/constant `MachineEnv`s. (#12596)* Update to new regalloc2 with constant MachineEnv.* Re-bless Cranelift filetests.* Re-bless Wasmtime disas tests.* Update to RA2 0.14.0.* Review feedback.* cargo-vet update. List of files: /wasmtime-44.0.1/tests/disas/winch/x64/fuel/call.wat/wasmtime-44.0.1/tests/disas/x64-simple-load.wat

7e0331c2 - Debugging: refactor stack frame cursor into frame handle abstraction. (#12566)

Wed, 11 Feb 2026 23:00:00 +0000

Debugging: refactor stack frame cursor into frame handle abstraction. (#12566)* Debugging: refactor stack frame cursor into frame handle abstraction.This addresses some of the issues described #12486: we need the abilityto keep a handle to a stack frame as long as execution is frozen, andkeep multiple of these handles around, alongside the `Store`, withoutany handle directly holding a borrow of the store.The frame handles work by means of an "execution version" scheme: theidea is that whenever any execution resumes in a given store, allhandles to existing frames could be invalidated, but if no suchexecution occurs, all handles should still be valid. A tuple of(globally unique for process lifetime) store ID, and execution versionwithin that store, should be sufficient to uniquely identify anyfrozen-stack period during execution. This accomplishes cheap handleinvalidation without the need to track existing handles.This PR also implements a cache of parsed frame-table data. Previouslythis was lazily parsed by the cursor as it walked up a stack, but withmultiple handles hanging around, and with handles meant to be cheap tohold and clone, and with handles being invalidated eagerly, it makesmuch more sense to persist this parsed metadata at the `Store` level.(It cannot persist at the `Engine` level because PCs are local perstore.)* Re-bless disas tests (offsets in VMStoreContext changed).* Handle invalidation tests.* Review comments, and make API return `Result`s rather than panic'ing on stale handles.* Review feedback.* Doc-comment link fix.* Review feedback.* cfg-gate Activation method to `debug` feature only.* Fix unused-import warning in no-debug cfg.* Fix doc link (again, after rename from latest feedback). List of files: /wasmtime-44.0.1/tests/disas/x64-simd-round-without-sse41.wat

35fcf782 - winch: Fix spectre-related table indexing comparison size (#12930)

Wed, 01 Apr 2026 16:00:00 +0000

winch: Fix spectre-related table indexing comparison size (#12930)This commit fixes a minor issue in the Winch backend when loading avalue from a table when spectre mitigations are enabled. In thissituation an extra comparison and conditional move is executed after theoriginal bounds check and load to specifically handle the speculationcase and ensure that out-of-bounds values can't be speculated on. Thecomparison performed on this path, however, was an incorrect one whereit unconditionally used a 32-bit comparison. The comparison insteadneeds to use `bound_size` to handle platform/table differences. Thismatches the actual bounds check, for example, which occurs prior to thespectre-related mitigation. List of files: /wasmtime-44.0.1/tests/disas/winch/x64/table/init_copy_drop.wat