Stream: git-wasmtime

Topic: wasmtime / issue #13196 misc fuzzbug: cancellation of asy...

view this post on Zulip Wasmtime GitHub notifications bot (Apr 25 2026 at 11:05):

olavblaak1 opened issue #13196:

<details>
<summary>Test case input</summary>

<!-- Please base64-encode the input that libFuzzer generated, and paste it in the code-block below. This is required for us to reproduce the issue. -->

Minimized: 

Bte+vqe+0NnZAA==

Additional reproducers:

BtG+vr6+vr6+vr6+vr6+vre+vr6+vr6+vqe+vie+0dE7CtAG0A==
Bgdm/zU1EgAA//8AxMTExMTExMTExMTExMQA/zX/NTU1NTXVNTU1QaampqampqampqampqampqYn1g==
BiVMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEz///8ATExMTExMTExMTExMTExMTExMTExMTExMTExMJiUGRUVFRQUAJgAAAAAAAAA=

</details>

<details>
<summary>cargo +nightly fuzz fmt output</summary>

<!-- If you can, please paste the output of cargo +nightly fuzz fmt <target> <input> in the code-block below. This will help reviewers more quickly triage this report. -->

Output of `std::fmt::Debug`:

[6, 209, 190, 190, 167, 190, 208, 209, 209, 0, 6]
  1. (GuestCaller, AsyncPendingImportCall(0))
  2. (GuestCallee, AsyncPendingImportCall(1))
  3. (GuestCaller, AsyncPendingImportCall(2))
  4. (GuestCaller, AsyncPendingImportCancel(2)) <- cancel
  5. (GuestCallee, AsyncPendingExportAssertCancelled(2)) <- export never notified

</details>

<details>
<summary>Stack trace or other relevant details</summary>

<!-- If you can, please paste anything that looks relevant from the failure message in the code-block below. This will help reviewers more quickly triage this report. -->

Guest Stack:

thread '<unnamed>' (1) panicked at crates/test-programs/src/bin/fuzz_async.rs:296:17:
expected async_pending export 2 to be cancelled
stack backtrace:
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

thread '<unnamed>' (13109317) panicked at crates/fuzzing/src/oracles/component_async.rs:264:14:
called `Result::unwrap()` on an `Err` value: error while executing at wasm backtrace:
    0: 0x157fc36 - abort
                    at wasisdk://v30.0/build/sysroot/wasi-libc-wasm32-wasip1-build-prefix/src/wasi-libc-wasm32-wasip1-build-build/wasisdk://v30.0/src/wasi-libc/libc-bottom-half/sources/abort.c:5:3
    1: 0x157a71f - std[353486b189d9db8e]::sys::pal::wasi::abort_internal
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/sys/pal/wasi/mod.rs:27:14
    2: 0x15790ad - std[353486b189d9db8e]::process::abort
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/process.rs:2536:5
    3: 0x1579601 - __rustc[ccd49f7a2776e796]::__rust_abort
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/rt.rs:33:5
    4: 0x1577b88 - __rustc[ccd49f7a2776e796]::__rust_start_panic
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/panic_abort/src/lib.rs:50:5
    5: 0x1579448 - __rustc[ccd49f7a2776e796]::rust_panic
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/panicking.rs:886:25
    6: 0x157898b - std[353486b189d9db8e]::panicking::panic_with_hook
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/panicking.rs:850:5
    7: 0x15785d2 - std[353486b189d9db8e]::panicking::panic_handler::{closure#0}
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/panicking.rs:698:13
    8: 0x1578536 - std[353486b189d9db8e]::sys::backtrace::__rust_end_short_backtrace::<std[353486b189d9db8e]::panicking::panic_handler::{closure#0}, !>
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/sys/backtrace.rs:182:18
    9: 0x15796e4 - __rustc[ccd49f7a2776e796]::rust_begin_unwind
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/panicking.rs:689:5
   10: 0x1584023 - core[49201cffbf193205]::panicking::panic_fmt
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/core/src/panicking.rs:80:14
   11: 0x13a07d8 - fuzz_async[839f4e22c52f1b77]::run::{closure#0}
                    at /Users/user/RustroverProjects/wasmtime/crates/test-programs/src/bin/fuzz_async.rs:296:17
   12: 0x156b138 - <core[49201cffbf193205]::pin::Pin<alloc[eb936df69ddeab91]::boxed::Box<dyn core[49201cffbf193205]::future::future::Future<Output = ()>>> as core[49201cffbf193205]::future::future::Future>::poll
                    at /Users/user/.rustup/toolchains/nightly-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/future/future.rs:133:9
                - <futures_util[b9000cebe7a53e1c]::stream::futures_unordered::FuturesUnordered<core[49201cffbf193205]::pin::Pin<alloc[eb936df69ddeab91]::boxed::Box<dyn core[49201cffbf193205]::future::future::Future<Output = ()>>>> as futures_core[a9bcc9d9db3f4fc]::stream::Stream>::poll_next
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/stream/futures_unordered/mod.rs:528:24
   13: 0x156b34b - <futures_util[b9000cebe7a53e1c]::stream::futures_unordered::FuturesUnordered<core[49201cffbf193205]::pin::Pin<alloc[eb936df69ddeab91]::boxed::Box<dyn core[49201cffbf193205]::future::future::Future<Output = ()>>>> as futures_util[b9000cebe7a53e1c]::stream::stream::StreamExt>::poll_next_unpin
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/stream/stream/mod.rs:1638:24
                - <wit_bindgen[af5e3c273ee61906]::rt::async_support::spawn::Tasks>::poll_next
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/wit-bindgen-0.57.0/src/rt/async_support/spawn.rs:31:34
   14: 0x156a5a1 - <wit_bindgen[af5e3c273ee61906]::rt::async_support::FutureState>::callback::{closure#0}
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/wit-bindgen-0.57.0/src/rt/async_support.rs:235:37
                - <wit_bindgen[af5e3c273ee61906]::rt::async_support::FutureState>::with_p3_task_set::<wit_bindgen[af5e3c273ee61906]::rt::async_support::CallbackCode, <wit_bindgen[af5e3c273ee61906]::rt::async_support::FutureState>::callback::{closure#0}>
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/wit-bindgen-0.57.0/src/rt/async_support.rs:326:9
                - <wit_bindgen[af5e3c273ee61906]::rt::async_support::FutureState>::callback
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/wit-bindgen-0.57.0/src/rt/async_support.rs:200:14
   15: 0x156ad00 - wit_bindgen[af5e3c273ee61906]::rt::async_support::callback
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/wit-bindgen-0.57.0/src/rt/async_support.rs:529:27
   16: 0x137f83f - fuzz_async[839f4e22c52f1b77]::exports::wasmtime_fuzz::fuzz::async_test::__callback_init
                    at /Users/user/RustroverProjects/wasmtime/crates/test-programs/src/bin/fuzz_async.rs:139:1
   17: 0x13b01f9 - [callback][async-lift]wasmtime-fuzz:fuzz/async-test#init
                    at /Users/user/RustroverProjects/wasmtime/crates/test-programs/src/bin/fuzz_async.rs:139:1

Caused by:
    wasm trap: wasm `unreachable` instruction executed

Host Stack:

thread '<unnamed>' panicked at crates/test-programs/src/bin/fuzz_async.rs:296:17:
expected async_pending export 2 to be cancelled

Caused by:
    wasm trap: wasm `unreachable` instruction executed

Host stack (relevant portion):
   12: call_callback
         at ./crates/wasmtime/src/runtime/component/concurrent.rs:2649
   15: handle_guest_call
         at ./crates/wasmtime/src/runtime/component/concurrent.rs:860
   34: run_on_worker::{async_fn#0}
         at ./crates/wasmtime/src/runtime/component/concurrent.rs:1811

subtask_cancel in ./crates/wasmtime/src/runtime/component/concurrent.rs does not seem to be on the code path for the reproducer. Every crash in this group shares the AsyncPendingImportCancel fuzzing command as the trigger.

Platform: aarch64-apple-darwin, wasmtime main as of 2026-04-24.

Reproduce:

RUST_BACKTRACE=1 WASMTIME_BACKTRACE_DETAILS=1 \
cargo +nightly fuzz run --no-default-features misc \
  fuzz/artifacts/misc/minimized-from-057c481db0a588c0a3c117b4c4a9fc066b3614c5

minimized-from-057c481db0a588c0a3c117b4c4a9fc066b3614c5.txt

Perhaps related: #12766, https://github.com/WebAssembly/WASI/issues/897

</details>

view this post on Zulip Wasmtime GitHub notifications bot (Apr 25 2026 at 11:05):

olavblaak1 added the bug label to Issue #13196.

view this post on Zulip Wasmtime GitHub notifications bot (Apr 25 2026 at 11:05):

olavblaak1 added the fuzz-bug label to Issue #13196.

view this post on Zulip Wasmtime GitHub notifications bot (Apr 27 2026 at 14:50):

alexcrichton added the wasm-proposal:component-model-async label to Issue #13196.

view this post on Zulip Wasmtime GitHub notifications bot (Apr 27 2026 at 15:31):

alexcrichton commented on issue #13196:

Thanks! I'll be taking a look at this today

view this post on Zulip Wasmtime GitHub notifications bot (Apr 28 2026 at 20:35):

alexcrichton closed issue #13196:

<details>
<summary>Test case input</summary>

<!-- Please base64-encode the input that libFuzzer generated, and paste it in the code-block below. This is required for us to reproduce the issue. -->

Minimized: 

Bte+vqe+0NnZAA==

Additional reproducers:

BtG+vr6+vr6+vr6+vr6+vre+vr6+vr6+vqe+vie+0dE7CtAG0A==
Bgdm/zU1EgAA//8AxMTExMTExMTExMTExMQA/zX/NTU1NTXVNTU1QaampqampqampqampqampqYn1g==
BiVMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEz///8ATExMTExMTExMTExMTExMTExMTExMTExMTExMJiUGRUVFRQUAJgAAAAAAAAA=

</details>

<details>
<summary>cargo +nightly fuzz fmt output</summary>

<!-- If you can, please paste the output of cargo +nightly fuzz fmt <target> <input> in the code-block below. This will help reviewers more quickly triage this report. -->

Output of `std::fmt::Debug`:

[6, 209, 190, 190, 167, 190, 208, 209, 209, 0, 6]
  1. (GuestCaller, AsyncPendingImportCall(0))
  2. (GuestCallee, AsyncPendingImportCall(1))
  3. (GuestCaller, AsyncPendingImportCall(2))
  4. (GuestCaller, AsyncPendingImportCancel(2)) <- cancel
  5. (GuestCallee, AsyncPendingExportAssertCancelled(2)) <- export never notified

</details>

<details>
<summary>Stack trace or other relevant details</summary>

<!-- If you can, please paste anything that looks relevant from the failure message in the code-block below. This will help reviewers more quickly triage this report. -->

Guest Stack:

thread '<unnamed>' (1) panicked at crates/test-programs/src/bin/fuzz_async.rs:296:17:
expected async_pending export 2 to be cancelled
stack backtrace:
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

thread '<unnamed>' (13109317) panicked at crates/fuzzing/src/oracles/component_async.rs:264:14:
called `Result::unwrap()` on an `Err` value: error while executing at wasm backtrace:
    0: 0x157fc36 - abort
                    at wasisdk://v30.0/build/sysroot/wasi-libc-wasm32-wasip1-build-prefix/src/wasi-libc-wasm32-wasip1-build-build/wasisdk://v30.0/src/wasi-libc/libc-bottom-half/sources/abort.c:5:3
    1: 0x157a71f - std[353486b189d9db8e]::sys::pal::wasi::abort_internal
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/sys/pal/wasi/mod.rs:27:14
    2: 0x15790ad - std[353486b189d9db8e]::process::abort
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/process.rs:2536:5
    3: 0x1579601 - __rustc[ccd49f7a2776e796]::__rust_abort
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/rt.rs:33:5
    4: 0x1577b88 - __rustc[ccd49f7a2776e796]::__rust_start_panic
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/panic_abort/src/lib.rs:50:5
    5: 0x1579448 - __rustc[ccd49f7a2776e796]::rust_panic
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/panicking.rs:886:25
    6: 0x157898b - std[353486b189d9db8e]::panicking::panic_with_hook
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/panicking.rs:850:5
    7: 0x15785d2 - std[353486b189d9db8e]::panicking::panic_handler::{closure#0}
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/panicking.rs:698:13
    8: 0x1578536 - std[353486b189d9db8e]::sys::backtrace::__rust_end_short_backtrace::<std[353486b189d9db8e]::panicking::panic_handler::{closure#0}, !>
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/sys/backtrace.rs:182:18
    9: 0x15796e4 - __rustc[ccd49f7a2776e796]::rust_begin_unwind
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/std/src/panicking.rs:689:5
   10: 0x1584023 - core[49201cffbf193205]::panicking::panic_fmt
                    at /rustc/17584a181979f04f2aaad867332c22db1caa511a/library/core/src/panicking.rs:80:14
   11: 0x13a07d8 - fuzz_async[839f4e22c52f1b77]::run::{closure#0}
                    at /Users/user/RustroverProjects/wasmtime/crates/test-programs/src/bin/fuzz_async.rs:296:17
   12: 0x156b138 - <core[49201cffbf193205]::pin::Pin<alloc[eb936df69ddeab91]::boxed::Box<dyn core[49201cffbf193205]::future::future::Future<Output = ()>>> as core[49201cffbf193205]::future::future::Future>::poll
                    at /Users/user/.rustup/toolchains/nightly-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/future/future.rs:133:9
                - <futures_util[b9000cebe7a53e1c]::stream::futures_unordered::FuturesUnordered<core[49201cffbf193205]::pin::Pin<alloc[eb936df69ddeab91]::boxed::Box<dyn core[49201cffbf193205]::future::future::Future<Output = ()>>>> as futures_core[a9bcc9d9db3f4fc]::stream::Stream>::poll_next
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/stream/futures_unordered/mod.rs:528:24
   13: 0x156b34b - <futures_util[b9000cebe7a53e1c]::stream::futures_unordered::FuturesUnordered<core[49201cffbf193205]::pin::Pin<alloc[eb936df69ddeab91]::boxed::Box<dyn core[49201cffbf193205]::future::future::Future<Output = ()>>>> as futures_util[b9000cebe7a53e1c]::stream::stream::StreamExt>::poll_next_unpin
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/stream/stream/mod.rs:1638:24
                - <wit_bindgen[af5e3c273ee61906]::rt::async_support::spawn::Tasks>::poll_next
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/wit-bindgen-0.57.0/src/rt/async_support/spawn.rs:31:34
   14: 0x156a5a1 - <wit_bindgen[af5e3c273ee61906]::rt::async_support::FutureState>::callback::{closure#0}
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/wit-bindgen-0.57.0/src/rt/async_support.rs:235:37
                - <wit_bindgen[af5e3c273ee61906]::rt::async_support::FutureState>::with_p3_task_set::<wit_bindgen[af5e3c273ee61906]::rt::async_support::CallbackCode, <wit_bindgen[af5e3c273ee61906]::rt::async_support::FutureState>::callback::{closure#0}>
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/wit-bindgen-0.57.0/src/rt/async_support.rs:326:9
                - <wit_bindgen[af5e3c273ee61906]::rt::async_support::FutureState>::callback
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/wit-bindgen-0.57.0/src/rt/async_support.rs:200:14
   15: 0x156ad00 - wit_bindgen[af5e3c273ee61906]::rt::async_support::callback
                    at /Users/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/wit-bindgen-0.57.0/src/rt/async_support.rs:529:27
   16: 0x137f83f - fuzz_async[839f4e22c52f1b77]::exports::wasmtime_fuzz::fuzz::async_test::__callback_init
                    at /Users/user/RustroverProjects/wasmtime/crates/test-programs/src/bin/fuzz_async.rs:139:1
   17: 0x13b01f9 - [callback][async-lift]wasmtime-fuzz:fuzz/async-test#init
                    at /Users/user/RustroverProjects/wasmtime/crates/test-programs/src/bin/fuzz_async.rs:139:1

Caused by:
    wasm trap: wasm `unreachable` instruction executed

Host Stack:

thread '<unnamed>' panicked at crates/test-programs/src/bin/fuzz_async.rs:296:17:
expected async_pending export 2 to be cancelled

Caused by:
    wasm trap: wasm `unreachable` instruction executed

Host stack (relevant portion):
   12: call_callback
         at ./crates/wasmtime/src/runtime/component/concurrent.rs:2649
   15: handle_guest_call
         at ./crates/wasmtime/src/runtime/component/concurrent.rs:860
   34: run_on_worker::{async_fn#0}
         at ./crates/wasmtime/src/runtime/component/concurrent.rs:1811

subtask_cancel in ./crates/wasmtime/src/runtime/component/concurrent.rs does not seem to be on the code path for the reproducer. Every crash in this group shares the AsyncPendingImportCancel fuzzing command as the trigger.

Platform: aarch64-apple-darwin, wasmtime main as of 2026-04-24.

Reproduce:

RUST_BACKTRACE=1 WASMTIME_BACKTRACE_DETAILS=1 \
cargo +nightly fuzz run --no-default-features misc \
  fuzz/artifacts/misc/minimized-from-057c481db0a588c0a3c117b4c4a9fc066b3614c5

minimized-from-057c481db0a588c0a3c117b4c4a9fc066b3614c5.txt

Perhaps related: #12766, https://github.com/WebAssembly/WASI/issues/897

</details>

Last updated: May 03 2026 at 22:13 UTC