shumbo opened PR #13054 from shumbo:fix-thread-new-indirect-arg-swap to bytecodealliance:main:
Summary
- Fix argument ordering bug in the
ThreadNewIndirecttrampoline incrates/cranelift/src/compiler/component.rswherestart_func_table_idxandstart_func_ty_idxwere passed to the hostthread_new_indirectlibcall in the wrong order- The host function signature expects
func_ty_idbeforefunc_table_idx, but the trampoline pushed them in the opposite order, causing the runtime to resolve functions from the wrong table when multiple tables are in use- Add a regression test with two tables that asserts the correct trap when calling
thread.new-indirecttargeting an empty tableDetails
The bug was invisible in the common single-table case where both indices are 0. With multiple tables, the swapped indices cause the runtime to look up a function in the wrong table instead of trapping.
Affected code:
crates/cranelift/src/compiler/component.rs, lines 768-769The fix swaps the two
params.pushcalls to match the expected parameter order in thethread_new_indirecthost function signature defined incrates/environ/src/component.rs.Test plan
- [x] New regression test
thread-new-indirect-multi-table.wastpasses (previously failed withexpected trap, got Component([U32(2)]))- [x] All existing
component-model-threadingtests still pass
shumbo requested alexcrichton for a review on PR #13054.
shumbo requested wasmtime-core-reviewers for a review on PR #13054.
shumbo requested wasmtime-compiler-reviewers for a review on PR #13054.
shumbo edited PR #13054:
Summary
- Fix argument ordering bug in the
ThreadNewIndirecttrampoline incrates/cranelift/src/compiler/component.rswherestart_func_table_idxandstart_func_ty_idxwere passed to the hostthread_new_indirectlibcall in the wrong order- The host function signature expects
func_ty_idbeforefunc_table_idx, but the trampoline pushed them in the opposite order, causing the runtime to resolve functions from the wrong table when multiple tables are in use- Add a regression test with two tables that asserts the correct trap when calling
thread.new-indirecttargeting an empty tableDetails
The bug was invisible in the common single-table case where both indices are 0. With multiple tables, the swapped indices cause the runtime to look up a function in the wrong table instead of trapping.
The fix swaps the two
params.pushcalls to match the expected parameter order in thethread_new_indirecthost function signature defined incrates/environ/src/component.rs.
shumbo updated PR #13054.
shumbo updated PR #13054.
Last updated: Apr 12 2026 at 23:10 UTC