Wasmtime GitHub notifications bot (Oct 28 2026 at 15:40): Wasmtime GitHub notifications bot (Oct 28 2026 at 15:40):Ranjeet2063 opened PR #15045 from Ranjeet2063:fix/elem-segment-eval-before-table-write-15036 to bytecodealliance:main:
Motivation
Per the WebAssembly Core Specification on module instantiation, all element segment expressions must be evaluated before applying any active segment's
table.init.Previously, during Cranelift module startup code generation (
crates/cranelift/src/func_environ.rs),module_initialize_table_with_segmentevaluated element expressions and immediately wrote them to the target table viatranslate_table_set. If a subsequent element expression trapped (e.g. allocation size too large, division by zero, or null reference), earlier table writes had already mutated imported tables, violating the specification invariant that a trapping expression must leave imported tables untouched.Solution
This PR splits active table segment initialization in
crates/cranelift/src/func_environ.rsinto two distinct phases:
module_prepare_table_segment:
- Evaluates segment offset expressions.
- Performs bounds checks before mutating any state.
- Pre-charges bulk operation fuel.
- Evaluates all element expressions / function references into Cranelift SSA values (
ir::Value).
module_apply_table_segment:
- Iterates over the prepared element values and writes them to the target table via
translate_table_set.- Post-charges bulk operation fuel.
During
compile_module_start, all active segments are prepared in Pass 1 before any segment applies table writes in Pass 2. If any element expression traps, execution aborts before any table mutation occurs.Includes regression test in
tests/misc_testsuite/issue15036.wast.Closes #15036
Wasmtime GitHub notifications bot (Oct 28 2026 at 15:40):Ranjeet2063 removed the review request for wasmtime-compiler-reviewers from PR #15045.
Wasmtime GitHub notifications bot (Oct 28 2026 at 15:40):Ranjeet2063 requested wasmtime-core-reviewers for a review on PR #15045.
Wasmtime GitHub notifications bot (Oct 28 2026 at 15:40):Ranjeet2063 requested wasmtime-compiler-reviewers for a review on PR #15045.
Wasmtime GitHub notifications bot (Oct 28 2026 at 15:40):Ranjeet2063 requested cfallin for a review on PR #15045.
Wasmtime GitHub notifications bot (Oct 28 2026 at 18:00)::cross_mark: Ranjeet2063 closed without merge PR #15045.
Wasmtime GitHub notifications bot (Oct 28 2026 at 18:00):Ranjeet2063 edited PR #15045:
Motivation
Per the WebAssembly Core Specification on module instantiation, all element segment expressions must be evaluated before applying any active segment's .
Previously, during Cranelift module startup code generation (), evaluated element expressions and immediately wrote them to the target table via . If a subsequent element expression trapped, earlier table writes had already mutated imported tables.
Scope & Status
Exploratory implementation splitting active table segment initialization in into two distinct phases. Resolving this fully requires coordinated architectural changes across multiple compiler backends (Cranelift, Winch, Pulley) and preservation of table Copy-On-Write optimizations.
Tracking issue: #15036
Wasmtime GitHub notifications bot (Oct 28 2026 at 18:00):Ranjeet2063 commented on PR #15045:
Closing this PR for now. After deeper inspection into Wasmtime's table initialization pipeline and spec test suite (specifically table COW optimizations and multi-backend parity with Winch/Pulley), properly decoupling element expression evaluation from active table writes requires a larger coordinated architectural design than this localized Cranelift pass. Will follow and participate in discussion on #15036 if an alternative unified design is proposed.
Last updated: Oct 31 2026 at 23:03 UTC