fitzgen opened PR #13528 from fitzgen:wasmtime-issue-13516 to bytecodealliance:main:
Garbage collection is incremental with respect to the Wasmtime embedder and
Future::poll, yielding between collection increments to cooperate with the async runtime; it is logically atomic with respect to the Wasm mutator.When the future driving an incremental collection is dropped before completion (e.g. an async
call_asyncfuture is cancelled while a GC is in progress), the copying collector's heap was left half-flipped and half-forwarded. Subsequent store reuse observed the half-collected state and corrupted the GC heap.We fix this situation by forcing any in-progress collection to finish synchronously in
CopyingCollection'sDrop. Other collectors do not actually do collection across multipleFuture::polls in any meaningful way and so cancellation does not lead to GC heap corruption for them.Fixes https://github.com/bytecodealliance/wasmtime/issues/13516
<!--
Please make sure you include the following information:
If this work has been discussed elsewhere, please include a link to that
conversation. If it was discussed in an issue, just mention "issue #...".Explain why this change is needed. If the details are in an issue already,
this can be brief.Our development process is documented in the Wasmtime book:
https://docs.wasmtime.dev/contributing-development-process.htmlPlease ensure all communication follows the code of conduct:
https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md
-->
fitzgen requested pchickey for a review on PR #13528.
fitzgen requested wasmtime-core-reviewers for a review on PR #13528.
:thumbs_up: pchickey submitted PR review.
alexcrichton commented on PR #13528:
Would it be possible to store the collection's intermediate state in the collector itself and automatically trigger a GC on future allocations? If a host is time-slicing a super long collection and ends up just having to block anyway to finish it that seems like something we'll ideally want to fix
fitzgen commented on PR #13528:
Would it be possible to store the collection's intermediate state in the collector itself and automatically trigger a GC on future allocations?
The problem is that even running Wasm code that doesn't allocate, but accesses GC object fields, will observe the half-collected state and crash (basically equivalent to running with GC heap corruption).
We would need to have every API that could transitively access the GC heap automatically check for this state and trigger collection if needed, which is not just like
call_asyncbut also things that aren'tasynclikeStructRef::field.I think the only realistic alternative to this PR would be to not make GC host-incremental at all, and if we ever want to have host-incremental GC then we would implement an actual concurrent-with-the-mutator incremental collector and do its incremental GC slices atomically and without interruption to avoid this same issue but "up a level"
alexcrichton added PR #13528 Finish interrupted copying collections to keep the GC heap consistent to the merge queue.
alexcrichton commented on PR #13528:
Good points yeah. I've filed https://github.com/bytecodealliance/wasmtime/issues/13530 to track this over time, but I agree there's really not a whole lot else we can do in the meantime.
github-merge-queue[bot] removed PR #13528 Finish interrupted copying collections to keep the GC heap consistent from the merge queue.
fitzgen added PR #13528 Finish interrupted copying collections to keep the GC heap consistent to the merge queue.
:check: fitzgen merged PR #13528.
fitzgen removed PR #13528 Finish interrupted copying collections to keep the GC heap consistent from the merge queue.
Last updated: Jul 29 2026 at 05:03 UTC