fitzgen opened PR #12934 from fitzgen:fix-stack-maps-for-try-call-lowering to bytecodealliance:main:
Branch instructions are skipped in the main lowering loop, which means the stack map forwarding code is never reached for them. The branch lowering path didn't forward stack maps either. This was fine because branch instructions couldn't previously ever be safepoints. However, with the introduction of
try_callandtry_call_indirect, we now have instructions that are both safepoints and branches.This caused GC references live across
try_call[_indirect]instructions to not be traced during garbage collection, leading to use-after-free within the GC heap sandbox when the collector swept those untraced-but-still-live objects.The fix adds stack map forwarding after branch lowering, mirroring the existing logic for non-branch instructions.
Fixes bytecodealliance/wasmtime#11753.
<!--
Please make sure you include the following information:
If this work has been discussed elsewhere, please include a link to that
conversation. If it was discussed in an issue, just mention "issue #...".Explain why this change is needed. If the details are in an issue already,
this can be brief.Our development process is documented in the Wasmtime book:
https://docs.wasmtime.dev/contributing-development-process.htmlPlease ensure all communication follows the code of conduct:
https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md
-->
fitzgen requested wasmtime-compiler-reviewers for a review on PR #12934.
fitzgen requested cfallin for a review on PR #12934.
fitzgen requested wasmtime-core-reviewers for a review on PR #12934.
fitzgen updated PR #12934.
cfallin submitted PR review:
LGTM -- good find; thanks!
cfallin added PR #12934 Preserve try_call[_indirect] stack maps during lowering to the merge queue.
cfallin merged PR #12934.
cfallin removed PR #12934 Preserve try_call[_indirect] stack maps during lowering from the merge queue.
Last updated: Apr 12 2026 at 23:10 UTC