saulecabrera opened PR #9554 from saulecabrera:winch-unaligned-stack-fuel to bytecodealliance:main:
This commit fixes a fuzz bug in which the stack was misaligned when calling the out-of-fuel builtin function.
The misalignment was introduced by a erroneous handling of the the control flow merge introduced by the fuel check conditional. In general, prior to every branch emission, a spill to memory is needed to avoid issues at the control flow merge.
Note that we don't have many cases like this one in Winch's codebase (3 in total), however as a follow-up, it's probably worth considering introducing a stronger abstraction around branching to ensure that this case is handled whenever an arbitrary branch needs to be introduced. This change solely focuses on the fix and does not introduce any refactoring. I plan to follow-up with investigating a better branching strategy, since we would need to introduce a similar pattern for epoch handling.
I used
wasm-tools shinkto shrink the original program, which I decided to add as part of an integration test.<!--
Please make sure you include the following information:
If this work has been discussed elsewhere, please include a link to that
conversation. If it was discussed in an issue, just mention "issue #...".Explain why this change is needed. If the details are in an issue already,
this can be brief.Our development process is documented in the Wasmtime book:
https://docs.wasmtime.dev/contributing-development-process.htmlPlease ensure all communication follows the code of conduct:
https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md
-->
saulecabrera requested cfallin for a review on PR #9554.
saulecabrera requested wasmtime-compiler-reviewers for a review on PR #9554.
saulecabrera requested alexcrichton for a review on PR #9554.
saulecabrera requested wasmtime-core-reviewers for a review on PR #9554.
saulecabrera created PR review comment:
@alexcrichton I'm not sure if you have thoughts on introducing test fixtures like this as I didn't see this pattern used for the rest of the integration tests. I tried to shrink the original program using
wasm-tools shrinkand it was able to shrink it by 30%, if you think the test programs should be as small as possible I can definitely spend a bit more time trying to reduce it further.
saulecabrera submitted PR review.
alexcrichton submitted PR review.
alexcrichton created PR review comment:
Nah I think this is fine, maybe put it in
tests/misc_testsuite/*.watthough and include! it from there?
github-actions[bot] commented on PR #9554:
Subscribe to Label Action
cc @saulecabrera
<details>
This issue or pull request has been labeled: "winch"Thus the following users have been cc'd because of the following labels:
- saulecabrera: winch
To subscribe or unsubscribe from this label, edit the <code>.github/subscribe-to-label.json</code> configuration file.
Learn more.
</details>
saulecabrera updated PR #9554.
alexcrichton commented on PR #9554:
@saulecabrera would you be ok backporting this to the release-27 branch? If you're busy I'm happy to take that on myself
saulecabrera merged PR #9554.
saulecabrera commented on PR #9554:
@alexcrichton I've opened https://github.com/bytecodealliance/wasmtime/pull/9564. Just to confirm, since 27 is not released yet, there's nothing to follow-up on after the backport lands, right?
alexcrichton commented on PR #9554:
Indeed, and thanks!
Last updated: Jan 09 2026 at 13:15 UTC