Stream: git-wasmtime

Topic: wasmtime / issue #13067 DRC free_list panic with addition...

Wasmtime GitHub notifications bot (Apr 13 2026 at 14:44):

alexcrichton added the wasm-proposal:gc label to Issue #13067.

Wasmtime GitHub notifications bot (Apr 13 2026 at 14:44):

alexcrichton opened issue #13067:

Given this (unminimized) input:

<details>

(module
  (rec
    (type (;0;) (sub (struct (field (mut f32)) (field (mut i16)) (field f32) (field (mut v128)) (field (mut i8)) (field (mut i16)) (field (mut i8)) (field (mut f64)))))
    (type (;1;) (array i8))
    (type (;2;) (struct (field (mut i16)) (field i8) (field (mut i16)) (field (mut f32)) (field (mut i8)) (field f64) (field i16) (field (mut i8)) (field (mut i16)) (field (mut i16)) (field (mut i16)) (field anyref) (field (mut i16)) (field i8) (field i8) (field (mut v128)) (field (mut i8)) (field (mut i8)) (field i16) (field (mut i8))))
    (type (;3;) (struct (field i8) (field i8) (field i8) (field (mut i8)) (field (mut i8)) (field v128) (field i16) (field (mut i8)) (field (mut i8)) (field i8) (field i8) (field (mut f32)) (field i8) (field i8) (field i16) (field (mut i8)) (field (mut f32)) (field (mut i64)) (field f64) (field (mut i8))))
    (type (;4;) (func (param f32 f32) (result v128)))
    (type (;5;) (sub (func (param f32))))
    (type (;6;) (sub (struct (field i64) (field (mut i8)) (field (mut i16)) (field (mut f64)) (field (mut f64)) (field i16) (field f32) (field f32) (field f32) (field (mut i16)) (field (mut f32)) (field (mut f64)) (field i8) (field (mut i8)) (field (mut f64)) (field f64) (field i16))))
    (type (;7;) (func (param i32 nullfuncref f64 f64 v128 f64 i32 f64) (result f64)))
    (type (;8;) (func (param i32) (result anyref f64)))
    (type (;9;) (sub (array (mut i16))))
    (type (;10;) (sub (array (mut i16))))
    (type (;11;) (array i8))
    (type (;12;) (array (mut i8)))
    (type (;13;) (sub (array (mut i8))))
    (type (;14;) (sub (func (param f32 i64 f32 f64 f32 f32 v128 f64) (result i64 i64 exnref v128 f64 i32 f32 v128 i32 f64 i64))))
    (type (;15;) (array i8))
    (type (;16;) (sub (array i8)))
    (type (;17;) (sub (array (mut i8))))
    (type (;18;) (sub (func (result v128 f64 f64 i32 f32 f32 f64))))
    (type (;19;) (sub (func (result f64))))
    (type (;20;) (struct (field (mut i16)) (field i8) (field (mut i8)) (field (mut i64)) (field i8) (field i16) (field i64) (field (mut i8)) (field i16) (field (mut f32)) (field (mut i64)) (field (mut f64)) (field f32)))
    (type (;21;) (sub 19 (func (result f64))))
    (type (;22;) (sub 17 (array (mut i8))))
    (type (;23;) (array (mut i8)))
    (type (;24;) (array (mut i8)))
    (type (;25;) (func (param i64 f64 i32 i64 i64 v128 i64) (result f64)))
    (type (;26;) (func (result f32 f64)))
    (type (;27;) (array i64))
    (type (;28;) (array i16))
    (type (;29;) (sub (array (mut i8))))
    (type (;30;) (func (param i32 structref)))
    (type (;31;) (func (param externref i64 f64) (result exnref exnref exnref f64)))
    (type (;32;) (func))
    (type (;33;) (func (param f64)))
    (type (;34;) (sub (array (mut i8))))
    (type (;35;) (sub (array i8)))
    (type (;36;) (sub 0 (struct (field (mut f32)) (field (mut i16)) (field f32) (field (mut v128)) (field (mut i8)) (field (mut i16)) (field (mut i8)) (field (mut f64)))))
    (type (;37;) (sub (array i16)))
    (type (;38;) (struct (field i32) (field i8) (field i8) (field i8) (field i8) (field i8) (field (mut i16)) (field (mut i16)) (field (mut i16)) (field (mut i16)) (field (mut (ref null 34))) (field (mut i8))))
    (type (;39;) (func (param f64 i64)))
    (type (;40;) (sub (func (param f32 i32 v128 f64 f64))))
    (type (;41;) (sub (struct (field i8) (field anyref) (field (mut i16)) (field i8) (field i8) (field (mut v128)) (field (mut i8)) (field (mut i16)) (field (mut i8)))))
    (type (;42;) (array (mut i16)))
    (type (;43;) (sub (array i8)))
    (type (;44;) (sub (array (mut i8))))
    (type (;45;) (func (param f64 i32) (result v128 i64 i32)))
    (type (;46;) (sub (struct (field i16) (field (mut i16)) (field (mut i16)) (field i8) (field i8) (field (mut i8)) (field i8) (field (mut i8)) (field (mut i8)) (field (mut i8)))))
    (type (;47;) (array (mut i8)))
    (type (;48;) (sub (struct (field f64) (field (mut i8)))))
    (type (;49;) (array (mut i8)))
    (type (;50;) (array i8))
    (type (;51;) (sub (struct (field f32) (field (mut i8)))))
    (type (;52;) (array (mut i8)))
    (type (;53;) (sub (array (mut i8))))
    (type (;54;) (array (mut i8)))
    (type (;55;) (array (mut i8)))
    (type (;56;) (array (mut i31ref)))
    (type (;57;) (struct (field i16) (field (mut i16)) (field (mut f32)) (field (mut i8)) (field (mut i8)) (field i8) (field (mut i8)) (field (mut i8))))
    (type (;58;) (array i16))
    (type (;59;) (sub 14 (func (param f32 i64 f32 f64 f32 f32 v128 f64) (result i64 i64 exnref v128 f64 i32 f32 v128 i32 f64 i64))))
    (type (;60;) (sub (func (param f32 funcref i64 f32))))
    (type (;61;) (sub (func (result v128 f64 f32 f64 f64 f64))))
    (type (;62;) (struct (field (mut i16)) (field i8) (field (mut i16)) (field (mut nullexternref)) (field (mut i16)) (field (mut i16)) (field (mut f32)) (field (mut i8)) (field f64) (field i16) (field (mut i8)) (field (mut i16)) (field (mut i16)) (field (mut i16)) (field (mut (ref null 53))) (field (mut i16)) (field (mut i8)) (field (mut i8)) (field anyref) (field (mut i8))))
    (type (;63;) (func (param f64) (result f32 i32)))
    (type (;64;) (sub 0 (struct (field (mut f32)) (field (mut i16)) (field f32) (field (mut v128)) (field (mut i8)) (field (mut i16)) (field (mut i8)) (field (mut f64)))))
    (type (;65;) (sub final 9 (array (mut i16))))
    (type (;66;) (sub (func (result v128 f64 f64 i32 f32 f32 f64))))
    (type (;67;) (sub (func (param i64))))
    (type (;68;) (func (param i32 v128 f64 f32 f64 f64 f64) (result f64 anyref f32 i64 f32 f64 f32 f32 v128 f64)))
    (type (;69;) (struct (field (mut i8)) (field (mut i64)) (field (mut v128)) (field (mut i8))))
  )
  (import "URWKT\u{9}\u{2}}\u{0}\u{0}\u{0}\u{0}\u{c}\u{0}\u{0}{'" "" (table (;0;) 21 213 (ref null 39)))
  (import "KT\u{9}\u{2}) WKT\u{9}\u{2}" "" (table (;1;) 1 10187 (ref null 17)))
  (import "8,'name':'CDCC" "" (global (;0;) (mut f64)))
  (import "z +proj=mbtfpp z +proj=;ieVEsmvnvert" "" (tag (;0;) (type 67) (param i64)))
  (import "_0=0\u{b}" "" (tag (;1;) (type 5) (param f32)))
  (global (;1;) (mut i64) i64.const 0)
  (global (;2;) (mut v128) v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000)
  (global (;3;) (mut i64) i64.const 0)
  (global (;4;) (mut i32) i32.const 0)
  (global (;5;) (mut i32) i32.const 0)
  (export "ECCC" (global 0))
  (export "main" (func 2))
  (func (;0;) (type 32))
  (func (;1;) (type 61) (result v128 f64 f32 f64 f64 f64)
    v128.const i32x4 0xde100000 0x690c370c 0x2f0c6e47 0x30303030
    f64.const 0x1.030303030303p-236 (;=0.000000000000000000000000000000000000000000000000000000000000000000000009162216479754085;)
    f32.const 0x1.fffff8p-128 (;=0.00000000000000000000000000000000000000587747;)
    f64.const -nan:0x7ffffffffffff (;=NaN;)
    f64.const 0x1.f73686935770dp+736 (;=710540255337142200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000;)
    f64.const 0x1.p-1027 (;=0.0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006953355807835;)
  )
  (func (;2;) (type 61) (result v128 f64 f32 f64 f64 f64)
    (local f64 i64 f32)
    i32.const 1048575
    try_table (result v128) ;; label = @1
      i64.const 34359738367
      table.size 0
      struct.new_default 36
      ref.null 53
      block (type 19) (result f64) ;; label = @2
        block (type 61) (result v128 f64 f32 f64 f64 f64) ;; label = @3
          local.get 0
          global.get 0
          f64.add
          i64.trunc_sat_f64_s
          table.size 0
          array.new 27
          local.get 1
          v128.const i32x4 0x276e7275 0x4f43273a 0x5245764e 0x4e4f4953
          loop (type 61) (result v128 f64 f32 f64 f64 f64) ;; label = @4
            table.size 0
            f64.const -nan:0xfffffffffffc0 (;=NaN;)
            i64.reinterpret_f64
            data.drop 0
            i32.wrap_i64
            i32.ne
            f32.convert_i32_u
            ref.null 1
            i64.const -232906745435090
            i32.const -8193
            i32.extend16_s
            i32.extend16_s
            i32.extend16_s
            i32.extend16_s
            i32.extend16_s
            array.new_fixed 35 0
            i32.const -32
            array.new_default 1
            global.get 0
            i64.trunc_sat_f64_s
            array.new_fixed 27 0
            extern.convert_any
            any.convert_extern
            loop (type 19) (result f64) ;; label = @5
              f32.const 0x1.88924p+55 (;=55249497000000000;)
              local.tee 2
              local.get 2
              f32.ne
              local.get 2
              f32.const inf (;=inf;)
              f32.eq
              local.get 2
              f32.const -inf (;=-inf;)
              f32.eq
              i32.or
              i32.or
              if ;; label = @6
                f32.const 0x0p+0 (;=0;)
                local.set 2
              end
              local.get 2
              f32.const -0x1.fffffep+30 (;=-2147483500;)
              f32.lt
              if ;; label = @6
                f32.const -0x1.fffffep+30 (;=-2147483500;)
                local.set 2
              end
              local.get 2
              f32.const 0x1.fffffep+30 (;=2147483500;)
              f32.gt
              if ;; label = @6
                f32.const 0x1.fffffep+30 (;=2147483500;)
                local.set 2
              end
              local.get 2
              i32.trunc_f32_s
              data.drop 0
              i32.con
[message truncated]

Wasmtime GitHub notifications bot (Apr 13 2026 at 14:44):

alexcrichton added the fuzz-bug label to Issue #13067.

Wasmtime GitHub notifications bot (Apr 15 2026 at 18:47):

fitzgen assigned fitzgen to issue #13067.

Wasmtime GitHub notifications bot (Apr 15 2026 at 22:09):

alexcrichton closed issue #13067:

Given this (unminimized) input:

<details>

(module
  (rec
    (type (;0;) (sub (struct (field (mut f32)) (field (mut i16)) (field f32) (field (mut v128)) (field (mut i8)) (field (mut i16)) (field (mut i8)) (field (mut f64)))))
    (type (;1;) (array i8))
    (type (;2;) (struct (field (mut i16)) (field i8) (field (mut i16)) (field (mut f32)) (field (mut i8)) (field f64) (field i16) (field (mut i8)) (field (mut i16)) (field (mut i16)) (field (mut i16)) (field anyref) (field (mut i16)) (field i8) (field i8) (field (mut v128)) (field (mut i8)) (field (mut i8)) (field i16) (field (mut i8))))
    (type (;3;) (struct (field i8) (field i8) (field i8) (field (mut i8)) (field (mut i8)) (field v128) (field i16) (field (mut i8)) (field (mut i8)) (field i8) (field i8) (field (mut f32)) (field i8) (field i8) (field i16) (field (mut i8)) (field (mut f32)) (field (mut i64)) (field f64) (field (mut i8))))
    (type (;4;) (func (param f32 f32) (result v128)))
    (type (;5;) (sub (func (param f32))))
    (type (;6;) (sub (struct (field i64) (field (mut i8)) (field (mut i16)) (field (mut f64)) (field (mut f64)) (field i16) (field f32) (field f32) (field f32) (field (mut i16)) (field (mut f32)) (field (mut f64)) (field i8) (field (mut i8)) (field (mut f64)) (field f64) (field i16))))
    (type (;7;) (func (param i32 nullfuncref f64 f64 v128 f64 i32 f64) (result f64)))
    (type (;8;) (func (param i32) (result anyref f64)))
    (type (;9;) (sub (array (mut i16))))
    (type (;10;) (sub (array (mut i16))))
    (type (;11;) (array i8))
    (type (;12;) (array (mut i8)))
    (type (;13;) (sub (array (mut i8))))
    (type (;14;) (sub (func (param f32 i64 f32 f64 f32 f32 v128 f64) (result i64 i64 exnref v128 f64 i32 f32 v128 i32 f64 i64))))
    (type (;15;) (array i8))
    (type (;16;) (sub (array i8)))
    (type (;17;) (sub (array (mut i8))))
    (type (;18;) (sub (func (result v128 f64 f64 i32 f32 f32 f64))))
    (type (;19;) (sub (func (result f64))))
    (type (;20;) (struct (field (mut i16)) (field i8) (field (mut i8)) (field (mut i64)) (field i8) (field i16) (field i64) (field (mut i8)) (field i16) (field (mut f32)) (field (mut i64)) (field (mut f64)) (field f32)))
    (type (;21;) (sub 19 (func (result f64))))
    (type (;22;) (sub 17 (array (mut i8))))
    (type (;23;) (array (mut i8)))
    (type (;24;) (array (mut i8)))
    (type (;25;) (func (param i64 f64 i32 i64 i64 v128 i64) (result f64)))
    (type (;26;) (func (result f32 f64)))
    (type (;27;) (array i64))
    (type (;28;) (array i16))
    (type (;29;) (sub (array (mut i8))))
    (type (;30;) (func (param i32 structref)))
    (type (;31;) (func (param externref i64 f64) (result exnref exnref exnref f64)))
    (type (;32;) (func))
    (type (;33;) (func (param f64)))
    (type (;34;) (sub (array (mut i8))))
    (type (;35;) (sub (array i8)))
    (type (;36;) (sub 0 (struct (field (mut f32)) (field (mut i16)) (field f32) (field (mut v128)) (field (mut i8)) (field (mut i16)) (field (mut i8)) (field (mut f64)))))
    (type (;37;) (sub (array i16)))
    (type (;38;) (struct (field i32) (field i8) (field i8) (field i8) (field i8) (field i8) (field (mut i16)) (field (mut i16)) (field (mut i16)) (field (mut i16)) (field (mut (ref null 34))) (field (mut i8))))
    (type (;39;) (func (param f64 i64)))
    (type (;40;) (sub (func (param f32 i32 v128 f64 f64))))
    (type (;41;) (sub (struct (field i8) (field anyref) (field (mut i16)) (field i8) (field i8) (field (mut v128)) (field (mut i8)) (field (mut i16)) (field (mut i8)))))
    (type (;42;) (array (mut i16)))
    (type (;43;) (sub (array i8)))
    (type (;44;) (sub (array (mut i8))))
    (type (;45;) (func (param f64 i32) (result v128 i64 i32)))
    (type (;46;) (sub (struct (field i16) (field (mut i16)) (field (mut i16)) (field i8) (field i8) (field (mut i8)) (field i8) (field (mut i8)) (field (mut i8)) (field (mut i8)))))
    (type (;47;) (array (mut i8)))
    (type (;48;) (sub (struct (field f64) (field (mut i8)))))
    (type (;49;) (array (mut i8)))
    (type (;50;) (array i8))
    (type (;51;) (sub (struct (field f32) (field (mut i8)))))
    (type (;52;) (array (mut i8)))
    (type (;53;) (sub (array (mut i8))))
    (type (;54;) (array (mut i8)))
    (type (;55;) (array (mut i8)))
    (type (;56;) (array (mut i31ref)))
    (type (;57;) (struct (field i16) (field (mut i16)) (field (mut f32)) (field (mut i8)) (field (mut i8)) (field i8) (field (mut i8)) (field (mut i8))))
    (type (;58;) (array i16))
    (type (;59;) (sub 14 (func (param f32 i64 f32 f64 f32 f32 v128 f64) (result i64 i64 exnref v128 f64 i32 f32 v128 i32 f64 i64))))
    (type (;60;) (sub (func (param f32 funcref i64 f32))))
    (type (;61;) (sub (func (result v128 f64 f32 f64 f64 f64))))
    (type (;62;) (struct (field (mut i16)) (field i8) (field (mut i16)) (field (mut nullexternref)) (field (mut i16)) (field (mut i16)) (field (mut f32)) (field (mut i8)) (field f64) (field i16) (field (mut i8)) (field (mut i16)) (field (mut i16)) (field (mut i16)) (field (mut (ref null 53))) (field (mut i16)) (field (mut i8)) (field (mut i8)) (field anyref) (field (mut i8))))
    (type (;63;) (func (param f64) (result f32 i32)))
    (type (;64;) (sub 0 (struct (field (mut f32)) (field (mut i16)) (field f32) (field (mut v128)) (field (mut i8)) (field (mut i16)) (field (mut i8)) (field (mut f64)))))
    (type (;65;) (sub final 9 (array (mut i16))))
    (type (;66;) (sub (func (result v128 f64 f64 i32 f32 f32 f64))))
    (type (;67;) (sub (func (param i64))))
    (type (;68;) (func (param i32 v128 f64 f32 f64 f64 f64) (result f64 anyref f32 i64 f32 f64 f32 f32 v128 f64)))
    (type (;69;) (struct (field (mut i8)) (field (mut i64)) (field (mut v128)) (field (mut i8))))
  )
  (import "URWKT\u{9}\u{2}}\u{0}\u{0}\u{0}\u{0}\u{c}\u{0}\u{0}{'" "" (table (;0;) 21 213 (ref null 39)))
  (import "KT\u{9}\u{2}) WKT\u{9}\u{2}" "" (table (;1;) 1 10187 (ref null 17)))
  (import "8,'name':'CDCC" "" (global (;0;) (mut f64)))
  (import "z +proj=mbtfpp z +proj=;ieVEsmvnvert" "" (tag (;0;) (type 67) (param i64)))
  (import "_0=0\u{b}" "" (tag (;1;) (type 5) (param f32)))
  (global (;1;) (mut i64) i64.const 0)
  (global (;2;) (mut v128) v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000)
  (global (;3;) (mut i64) i64.const 0)
  (global (;4;) (mut i32) i32.const 0)
  (global (;5;) (mut i32) i32.const 0)
  (export "ECCC" (global 0))
  (export "main" (func 2))
  (func (;0;) (type 32))
  (func (;1;) (type 61) (result v128 f64 f32 f64 f64 f64)
    v128.const i32x4 0xde100000 0x690c370c 0x2f0c6e47 0x30303030
    f64.const 0x1.030303030303p-236 (;=0.000000000000000000000000000000000000000000000000000000000000000000000009162216479754085;)
    f32.const 0x1.fffff8p-128 (;=0.00000000000000000000000000000000000000587747;)
    f64.const -nan:0x7ffffffffffff (;=NaN;)
    f64.const 0x1.f73686935770dp+736 (;=710540255337142200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000;)
    f64.const 0x1.p-1027 (;=0.0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006953355807835;)
  )
  (func (;2;) (type 61) (result v128 f64 f32 f64 f64 f64)
    (local f64 i64 f32)
    i32.const 1048575
    try_table (result v128) ;; label = @1
      i64.const 34359738367
      table.size 0
      struct.new_default 36
      ref.null 53
      block (type 19) (result f64) ;; label = @2
        block (type 61) (result v128 f64 f32 f64 f64 f64) ;; label = @3
          local.get 0
          global.get 0
          f64.add
          i64.trunc_sat_f64_s
          table.size 0
          array.new 27
          local.get 1
          v128.const i32x4 0x276e7275 0x4f43273a 0x5245764e 0x4e4f4953
          loop (type 61) (result v128 f64 f32 f64 f64 f64) ;; label = @4
            table.size 0
            f64.const -nan:0xfffffffffffc0 (;=NaN;)
            i64.reinterpret_f64
            data.drop 0
            i32.wrap_i64
            i32.ne
            f32.convert_i32_u
            ref.null 1
            i64.const -232906745435090
            i32.const -8193
            i32.extend16_s
            i32.extend16_s
            i32.extend16_s
            i32.extend16_s
            i32.extend16_s
            array.new_fixed 35 0
            i32.const -32
            array.new_default 1
            global.get 0
            i64.trunc_sat_f64_s
            array.new_fixed 27 0
            extern.convert_any
            any.convert_extern
            loop (type 19) (result f64) ;; label = @5
              f32.const 0x1.88924p+55 (;=55249497000000000;)
              local.tee 2
              local.get 2
              f32.ne
              local.get 2
              f32.const inf (;=inf;)
              f32.eq
              local.get 2
              f32.const -inf (;=-inf;)
              f32.eq
              i32.or
              i32.or
              if ;; label = @6
                f32.const 0x0p+0 (;=0;)
                local.set 2
              end
              local.get 2
              f32.const -0x1.fffffep+30 (;=-2147483500;)
              f32.lt
              if ;; label = @6
                f32.const -0x1.fffffep+30 (;=-2147483500;)
                local.set 2
              end
              local.get 2
              f32.const 0x1.fffffep+30 (;=2147483500;)
              f32.gt
              if ;; label = @6
                f32.const 0x1.fffffep+30 (;=2147483500;)
                local.set 2
              end
              local.get 2
              i32.trunc_f32_s
              data.drop 0
              i32.con
[message truncated]

Last updated: May 03 2026 at 22:13 UTC