39e910be - [44.0.0] Merged backports for security advisories (#13007)

Thu, 09 Apr 2026 17:00:00 +0000

[44.0.0] Merged backports for security advisories (#13007)* fix(environ): repair unsound StringPool::try_clone()The 43.0 release introduced a soundness bug in StringPool::try_clone(): thecloned map retains &'static str keys pointing into the original pool'sstrings storage. Once the original Linker is dropped those keys dangle.Cloning a Linker, then dropping the original one, leaves a linker whoseregistered imports could no longer be found, causing instantiation tofail with "unknown import".Signed-off-by: Flavio Castelli * Fix pooling allocator predicate to reset VM permissionsThis commit fixes a mistake that was introduced in #9583 where the logicto reset a linear memory slot in the pooling allocator used the wrongpredicate. Specifically VM permissions must be reset if virtual memorycan be relied on at all, and the preexisting predicate of`can_elide_bounds_check` was an inaccurate representation of this. Thecorrect predicate to check is `can_use_virtual_memory`.* winch: Fix the type of the `table.size` output registerThis commit corrects the tagged size of the output of the `table.size`instruction. Previously this was hardcoded as a 32-bit integer insteadof consulting the table's index type to use theindex-type-sized-register instead.* winch: Fix a host panic when executing `table.fill`This commit fixes a possible panic when a Winch-compiled module executesthe `table.fill` instruction. Refactoring in #11254 updated Craneliftbut forgot to update Winch meaning that Winch's indices were still usingthe module-level indices instead of the `DefinedTableIndex` space. Thisadds some tests and updates Winch's translation to use preexistinghelpers.* x64: Fix `f64x2.splat` without SSE3Don't sink a load into `pshufd` which loads 16 bytes, instead force`put_in_xmm` to ensure only 8 bytes are loaded.* Properly verify alignment in string transcodingThis commit updates string transcoding between guest modules to properlyverify alignment. Previously alignment was only verified on the firstallocation, not reallocations, which is not spec-compliant. Thisadditionally fixes a possible host panic when dealing with unalignedpointers.* Fix type confusion in AArch64 amode RegScaled folding* winch: Add add_uextend to perform explicit extension when needed.This commit fixes an out-of-bounds access caused by the lack zeroextension in the code responsible for calculating the heap address forloads/stores.This issue manifests in aarch64 (unlike x64) given that no automaticextension is performed, resulting in an out-of-bounds access.An alternative approach is to emit an extend for the index, howeverthis approach is preferred given that it gives the MacroAssemblerlayer better control of how to lower addition, e.g., in aarch64 we caninline the desired extension in a single instruction.* winch: Correctly type the result of table.growThis commit fixes an out-of-bounds access caused by the lack of typenarrowing from the `table.grow` builtin. Without explicit narrowing,the type is treated as 64-bit value, which could cause issues whenpaired with loads/stores.* Review comments* Properly handle table index typesOnly narrow when dealing with the 64-bit pointer/32-bit tables* Fix panic with out-of-bounds flags in `Value`This commit fixes a panic when a component model `Value` is lifted froma flags value which specifies out-of-bounds bits as 1. This is specifiedin the component model to ignore the out-of-bounds bits, which `flags!`correctly did (and thus `bindgen!`), but `Value` treated out-of-boundsbits as a panic due to indexing an array.* Fix bounds checks in FACT's `string_to_compact` methodWe need to bounds check the source byte length, not the number of code units.* Add missing realloc validation in string transcodingThis commit adds a missing validation that a return value of `realloc`is inbounds during string transcoding. This was accidentally missing onthe transcoding path from `utf8` to `latin1+utf16` which meant that anearly-raw pointer could get passed to the host to perform thetranscode.* winch: Refine zero extension heuristicThis commit refines the zero extension heuristic such that itunconditionally emits a zero extension when dealing with 32-bitheaps. This eliminates any ambiguity related to the value of thememory indices across ISAs.* Fix failure on 32-bit* Fix miri test---------Signed-off-by: Flavio Castelli Co-authored-by: Flavio Castelli Co-authored-by: Shun Kashiwa Co-authored-by: Saúl Cabrera Co-authored-by: Nick Fitzgerald List of files: /wasmtime-44.0.1/winch/codegen/src/codegen/bounds.rs/wasmtime-44.0.1/winch/codegen/src/codegen/mod.rs/wasmtime-44.0.1/winch/codegen/src/isa/aarch64/asm.rs/wasmtime-44.0.1/winch/codegen/src/isa/aarch64/masm.rs/wasmtime-44.0.1/winch/codegen/src/isa/x64/masm.rs/wasmtime-44.0.1/winch/codegen/src/masm.rs/wasmtime-44.0.1/winch/codegen/src/visitor.rs

def5998e - Remove `cranelift_entity::{Signed, Unsigned}` (#11400)

Thu, 07 Aug 2025 23:00:00 +0000

Remove `cranelift_entity::{Signed, Unsigned}` (#11400)Use `*::cast_{un,}signed` in the Rust standard library stabilized in1.87. List of files: /wasmtime-44.0.1/winch/codegen/src/isa/x64/asm.rs

9acefdfe - Merge `wasmtime-math` into `wasmtime-core` (#12398)

Fri, 23 Jan 2026 16:00:00 +0000

Merge `wasmtime-math` into `wasmtime-core` (#12398)* Merge `wasmtime-math` into `wasmtime-core`No real need to have two "core" crates, let's just have one.* Fix warnings List of files: /wasmtime-44.0.1/winch/codegen/Cargo.toml

Changes in codegen

39e910be - [44.0.0] Merged backports for security advisories (#13007)

def5998e - Remove `cranelift_entity::{Signed, Unsigned}` (#11400)

9acefdfe - Merge `wasmtime-math` into `wasmtime-core` (#12398)