Stream: git-wasmtime

Topic: wasmtime / issue #10613 Winch: Wrong result with br_table...

Wasmtime GitHub notifications bot (Apr 18 2025 at 15:01):

alexcrichton added the fuzz-bug label to Issue #10613.

Wasmtime GitHub notifications bot (Apr 18 2025 at 15:01):

alexcrichton added the winch label to Issue #10613.

Wasmtime GitHub notifications bot (Apr 18 2025 at 15:01):

alexcrichton opened issue #10613:

Extracted from https://oss-fuzz.com/testcase-detail/5727091947798528 this module:

(module
  (func (export "e") (result i64 f64)
    call $a
    block $block (result i64 f64)
      call $b
      i32.const 1
      br_table $block 1 $block
      unreachable
    end
    unreachable
  )
  (func $a (result i64 f64)
    i64.const 4
    f64.const 5
  )
  (func $b (result i64 f64)
    i64.const 7
    f64.const 8
  )
)

shows:

$ cargo run -q -- --invoke e -Ccompiler=cranelift testcase0.wat
warning: using `--invoke` with a function that returns values is experimental and may break in the future
7
8
$ cargo run -q -- --invoke e -Ccompiler=winch testcase0.wat
warning: using `--invoke` with a function that returns values is experimental and may break in the future
4
8

where the 7/8 combo is what this module should produce.

cc @saulecabrera @jeffcharles

Wasmtime GitHub notifications bot (Apr 21 2025 at 11:50):

saulecabrera commented on issue #10613:

Thanks Alex, taking a look.

Wasmtime GitHub notifications bot (Apr 21 2025 at 17:23):

saulecabrera assigned saulecabrera to issue #10613.

Wasmtime GitHub notifications bot (May 01 2025 at 23:45):

saulecabrera commented on issue #10613:

I finally was able to set aside some time to look at this issue. I have located the exact place to where this issue is happening. In some cases, like the one above, stack results are not correctly shuffled before performing the jump required by br_table. I'm currently working on a fix.

Wasmtime GitHub notifications bot (May 01 2025 at 23:46):

saulecabrera edited a comment on issue #10613:

I was finally able to set aside some time to look at this issue. I have located the exact place to where this issue is happening. In some cases, like the one above, stack results are not correctly shuffled before performing the jump required by br_table. I'm currently working on a fix.

Wasmtime GitHub notifications bot (May 05 2025 at 21:15):

alexcrichton closed issue #10613:

Extracted from https://oss-fuzz.com/testcase-detail/5727091947798528 this module:

(module
  (func (export "e") (result i64 f64)
    call $a
    block $block (result i64 f64)
      call $b
      i32.const 1
      br_table $block 1 $block
      unreachable
    end
    unreachable
  )
  (func $a (result i64 f64)
    i64.const 4
    f64.const 5
  )
  (func $b (result i64 f64)
    i64.const 7
    f64.const 8
  )
)

shows:

$ cargo run -q -- --invoke e -Ccompiler=cranelift testcase0.wat
warning: using `--invoke` with a function that returns values is experimental and may break in the future
7
8
$ cargo run -q -- --invoke e -Ccompiler=winch testcase0.wat
warning: using `--invoke` with a function that returns values is experimental and may break in the future
4
8

where the 7/8 combo is what this module should produce.

cc @saulecabrera @jeffcharles

Last updated: Dec 06 2025 at 06:05 UTC