Stream: git-wasmtime

Topic: wasmtime / issue #14301 fuzzbug: gc_ops: assertion failed...

Wasmtime GitHub notifications bot (Sep 08 2026 at 18:57):

khagankhan opened issue #14301:

Found by the gc_ops fuzz target and reduced to a standalone .wast, so there is no
libFuzzer input or cargo fuzz fmt output to paste.

wasmtime 50.0.0-dev (596675762 2026-09-08)

ref.test against a concrete struct type, on an anyref that came from
any.convert_extern of a host externref, loads the reserved
VMSharedTypeIndex (u32::MAX) out of the object's VMGcHeader and hands it
to the is_subtype libcall.

Reproduce

minimal.wast:

(module
  (type $s (sub (struct)))
  (func (export "run") (param externref) (result i32)
    local.get 0
    any.convert_extern
    ref.test (ref null $s)))

(assert_return (invoke "run" (ref.extern 1)) (i32.const 0))

$ ./target/debug/wasmtime wast minimal.wast
thread 'main' panicked at crates/environ/src/types.rs:1701:1:
assertion failed: x < u32::MAX
...
thread caused non-unwinding panic. aborting.
Aborted

Only builds with debug assertions abort.

+cc @fitzgen

<details>
<summary>Full panic output</summary>

thread 'main' (1339244) panicked at crates/environ/src/types.rs:1701:1:
assertion failed: x < u32::MAX
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

thread 'main' (1339244) panicked at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/panicking.rs:225:5:
panic in a function that cannot unwind
stack backtrace:
   0:     0x5565ff4d3501 - std[5167731717db2e51]::backtrace_rs::backtrace::libunwind::trace
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/../../backtrace/src/backtrace/libunwind.rs:117:9
   1:     0x5565ff4d3501 - std[5167731717db2e51]::backtrace_rs::backtrace::trace_unsynchronized::<std[5167731717db2e51]::sys::backtrace::_print_fmt::{closure#1}>
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/../../backtrace/src/backtrace/mod.rs:66:14
   2:     0x5565ff4d3501 - std[5167731717db2e51]::sys::backtrace::_print_fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/sys/backtrace.rs:74:9
   3:     0x5565ff4d3501 - <<std[5167731717db2e51]::sys::backtrace::BacktraceLock>::print::DisplayBacktrace as core[8c5ac2f034688f9a]::fmt::Display>::fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/sys/backtrace.rs:44:26
   4:     0x5565ff4ef29a - <core[8c5ac2f034688f9a]::fmt::rt::Argument>::fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/fmt/rt.rs:152:76
   5:     0x5565ff4ef29a - core[8c5ac2f034688f9a]::fmt::write
   6:     0x5565ff4db1fc - std[5167731717db2e51]::io::default_write_fmt::<std[5167731717db2e51]::sys::stdio::unix::Stderr>
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/io/mod.rs:626:11
   7:     0x5565ff4db1fc - <std[5167731717db2e51]::sys::stdio::unix::Stderr as std[5167731717db2e51]::io::Write>::write_fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/io/mod.rs:1730:13
   8:     0x5565ff4ad476 - <std[5167731717db2e51]::sys::backtrace::BacktraceLock>::print
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/sys/backtrace.rs:47:9
   9:     0x5565ff4ad476 - std[5167731717db2e51]::panicking::default_hook::{closure#0}
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:292:27
  10:     0x5565ff4c9181 - std[5167731717db2e51]::panicking::default_hook
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:319:9
  11:     0x5565ff4c94ab - std[5167731717db2e51]::panicking::panic_with_hook
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:815:13
  12:     0x5565ff4ad554 - std[5167731717db2e51]::panicking::panic_handler::{closure#0}
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:681:13
  13:     0x5565ff4a1aa9 - std[5167731717db2e51]::sys::backtrace::__rust_end_short_backtrace::<std[5167731717db2e51]::panicking::panic_handler::{closure#0}, !>
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/sys/backtrace.rs:182:18
  14:     0x5565ff4ae57d - __rustc[4b1ee1ef74718a7b]::rust_begin_unwind
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:679:5
  15:     0x5565ff4ef93d - core[8c5ac2f034688f9a]::panicking::panic_nounwind_fmt::runtime
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/panicking.rs:122:22
  16:     0x5565ff4ef93d - core[8c5ac2f034688f9a]::panicking::panic_nounwind_fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/intrinsics/mod.rs:2458:9
  17:     0x5565ff4ef8bb - core[8c5ac2f034688f9a]::panicking::panic_nounwind
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/panicking.rs:225:5
  18:     0x5565ff4efa47 - core[8c5ac2f034688f9a]::panicking::panic_cannot_unwind
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/panicking.rs:337:5
  19:     0x5565fcc21790 - wasmtime[6a6622933b56cad6]::runtime::vm::libcalls::raw::is_subtype
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/libcalls.rs:115:17
  20:     0x7fcabba791ab - <unknown>
  21:     0x7fcabba7905d - <unknown>
  22:     0x7fcabba790b5 - <unknown>
  23:     0x5565fbdfa93f - <wasmtime[6a6622933b56cad6]::runtime::vm::vmcontext::VMFuncRef>::array_call_native
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/vmcontext.rs:658:13
  24:     0x5565fbdfa88f - <wasmtime[6a6622933b56cad6]::runtime::vm::vmcontext::VMFuncRef>::array_call
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/vmcontext.rs:615:30
  25:     0x5565fbe1cac9 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw::<()>::{closure#0}
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1032:13
  26:     0x5565fbd52029 - wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps::<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>::{closure#0}
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:470:32
  27:     0x5565fbd51ede - <wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::call_thread_state::CallThreadState>::with::<wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>::{closure#0}>::{closure#0}
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:716:50
  28:     0x5565fbeb638c - wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::tls::set::<bool, <wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::call_thread_state::CallThreadState>::with<wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>::{closure#0}>::{closure#0}>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:1444:13
  29:     0x5565fbd5c968 - <wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::call_thread_state::CallThreadState>::with::<wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>::{closure#0}>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:716:25
  30:     0x5565fbd4ed0d - wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps::<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:467:59
  31:     0x5565fbe1809f - wasmtime[6a6622933b56cad6]::runtime::func::invoke_wasm_and_catch_traps::<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1475:18
  32:     0x5565fbe17268 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw::<()>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1031:9
  33:     0x5565fbe16911 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked::<&mut wasmtime[6a6622933b56cad6]::runtime::store::context::StoreContextMut<()>>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1021:18
  34:     0x5565fbe16d47 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_impl_do_call::<()>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1194:18
  35:     0x5565fbe1caf1 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_async::<&mut wasmtime[6a6622933b56cad6]::runtime::store::Store<()>>::{closure#0}::{closure#0}
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1124:45
  36:     0x5565fbd25d1d - <wasmtime[6a6622933b56cad6]::runtime::store::context::StoreContextMut<()>>::on_fiber::<core[8c5ac2f034688f9a]::result::Result<(), wasmtime_internal_core[8ad56e039512ccb9]::error::error::Error>, <wasmtime[6a6622933b56cad6]::runtime::func::Func
[message truncated]

Wasmtime GitHub notifications bot (Sep 08 2026 at 18:57):

khagankhan added the bug label to Issue #14301.

Wasmtime GitHub notifications bot (Sep 08 2026 at 18:57):

khagankhan added the fuzz-bug label to Issue #14301.

Wasmtime GitHub notifications bot (Sep 08 2026 at 19:02):

alexcrichton added the wasm-proposal:gc label to Issue #14301.

Wasmtime GitHub notifications bot (Sep 09 2026 at 06:33):

khagankhan edited issue #14301:

Found by the gc_ops fuzz target and reduced to a standalone .wast, so there is no need for
libFuzzer input or cargo fuzz fmt output to paste.

wasmtime 50.0.0-dev (596675762 2026-09-08)

ref.test against a concrete struct type, on an anyref that came from
any.convert_extern of a host externref, loads the reserved
VMSharedTypeIndex (u32::MAX) out of the object's VMGcHeader and hands it
to the is_subtype libcall.

Reproduce

minimal.wast:

(module
  (type $s (sub (struct)))
  (func (export "run") (param externref) (result i32)
    local.get 0
    any.convert_extern
    ref.test (ref null $s)))

(assert_return (invoke "run" (ref.extern 1)) (i32.const 0))

$ ./target/debug/wasmtime wast minimal.wast
thread 'main' panicked at crates/environ/src/types.rs:1701:1:
assertion failed: x < u32::MAX
...
thread caused non-unwinding panic. aborting.
Aborted

Only builds with debug assertions abort.

+cc @fitzgen

<details>
<summary>Full panic output</summary>

thread 'main' (1339244) panicked at crates/environ/src/types.rs:1701:1:
assertion failed: x < u32::MAX
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

thread 'main' (1339244) panicked at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/panicking.rs:225:5:
panic in a function that cannot unwind
stack backtrace:
   0:     0x5565ff4d3501 - std[5167731717db2e51]::backtrace_rs::backtrace::libunwind::trace
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/../../backtrace/src/backtrace/libunwind.rs:117:9
   1:     0x5565ff4d3501 - std[5167731717db2e51]::backtrace_rs::backtrace::trace_unsynchronized::<std[5167731717db2e51]::sys::backtrace::_print_fmt::{closure#1}>
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/../../backtrace/src/backtrace/mod.rs:66:14
   2:     0x5565ff4d3501 - std[5167731717db2e51]::sys::backtrace::_print_fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/sys/backtrace.rs:74:9
   3:     0x5565ff4d3501 - <<std[5167731717db2e51]::sys::backtrace::BacktraceLock>::print::DisplayBacktrace as core[8c5ac2f034688f9a]::fmt::Display>::fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/sys/backtrace.rs:44:26
   4:     0x5565ff4ef29a - <core[8c5ac2f034688f9a]::fmt::rt::Argument>::fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/fmt/rt.rs:152:76
   5:     0x5565ff4ef29a - core[8c5ac2f034688f9a]::fmt::write
   6:     0x5565ff4db1fc - std[5167731717db2e51]::io::default_write_fmt::<std[5167731717db2e51]::sys::stdio::unix::Stderr>
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/io/mod.rs:626:11
   7:     0x5565ff4db1fc - <std[5167731717db2e51]::sys::stdio::unix::Stderr as std[5167731717db2e51]::io::Write>::write_fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/io/mod.rs:1730:13
   8:     0x5565ff4ad476 - <std[5167731717db2e51]::sys::backtrace::BacktraceLock>::print
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/sys/backtrace.rs:47:9
   9:     0x5565ff4ad476 - std[5167731717db2e51]::panicking::default_hook::{closure#0}
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:292:27
  10:     0x5565ff4c9181 - std[5167731717db2e51]::panicking::default_hook
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:319:9
  11:     0x5565ff4c94ab - std[5167731717db2e51]::panicking::panic_with_hook
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:815:13
  12:     0x5565ff4ad554 - std[5167731717db2e51]::panicking::panic_handler::{closure#0}
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:681:13
  13:     0x5565ff4a1aa9 - std[5167731717db2e51]::sys::backtrace::__rust_end_short_backtrace::<std[5167731717db2e51]::panicking::panic_handler::{closure#0}, !>
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/sys/backtrace.rs:182:18
  14:     0x5565ff4ae57d - __rustc[4b1ee1ef74718a7b]::rust_begin_unwind
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:679:5
  15:     0x5565ff4ef93d - core[8c5ac2f034688f9a]::panicking::panic_nounwind_fmt::runtime
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/panicking.rs:122:22
  16:     0x5565ff4ef93d - core[8c5ac2f034688f9a]::panicking::panic_nounwind_fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/intrinsics/mod.rs:2458:9
  17:     0x5565ff4ef8bb - core[8c5ac2f034688f9a]::panicking::panic_nounwind
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/panicking.rs:225:5
  18:     0x5565ff4efa47 - core[8c5ac2f034688f9a]::panicking::panic_cannot_unwind
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/panicking.rs:337:5
  19:     0x5565fcc21790 - wasmtime[6a6622933b56cad6]::runtime::vm::libcalls::raw::is_subtype
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/libcalls.rs:115:17
  20:     0x7fcabba791ab - <unknown>
  21:     0x7fcabba7905d - <unknown>
  22:     0x7fcabba790b5 - <unknown>
  23:     0x5565fbdfa93f - <wasmtime[6a6622933b56cad6]::runtime::vm::vmcontext::VMFuncRef>::array_call_native
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/vmcontext.rs:658:13
  24:     0x5565fbdfa88f - <wasmtime[6a6622933b56cad6]::runtime::vm::vmcontext::VMFuncRef>::array_call
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/vmcontext.rs:615:30
  25:     0x5565fbe1cac9 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw::<()>::{closure#0}
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1032:13
  26:     0x5565fbd52029 - wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps::<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>::{closure#0}
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:470:32
  27:     0x5565fbd51ede - <wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::call_thread_state::CallThreadState>::with::<wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>::{closure#0}>::{closure#0}
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:716:50
  28:     0x5565fbeb638c - wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::tls::set::<bool, <wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::call_thread_state::CallThreadState>::with<wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>::{closure#0}>::{closure#0}>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:1444:13
  29:     0x5565fbd5c968 - <wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::call_thread_state::CallThreadState>::with::<wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>::{closure#0}>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:716:25
  30:     0x5565fbd4ed0d - wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps::<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:467:59
  31:     0x5565fbe1809f - wasmtime[6a6622933b56cad6]::runtime::func::invoke_wasm_and_catch_traps::<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1475:18
  32:     0x5565fbe17268 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw::<()>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1031:9
  33:     0x5565fbe16911 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked::<&mut wasmtime[6a6622933b56cad6]::runtime::store::context::StoreContextMut<()>>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1021:18
  34:     0x5565fbe16d47 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_impl_do_call::<()>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1194:18
  35:     0x5565fbe1caf1 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_async::<&mut wasmtime[6a6622933b56cad6]::runtime::store::Store<()>>::{closure#0}::{closure#0}
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1124:45
  36:     0x5565fbd25d1d - <wasmtime[6a6622933b56cad6]::runtime::store::context::StoreContextMut<()>>::on_fiber::<core[8c5ac2f034688f9a]::result::Result<(), wasmtime_internal_core[8ad56e039512ccb9]::error::error::Error>, <wasmtime[6a6622933b56cad6]::runtime::f
[message truncated]

Wasmtime GitHub notifications bot (Sep 10 2026 at 17:01):

fitzgen assigned fitzgen to issue #14301.

Wasmtime GitHub notifications bot (Sep 10 2026 at 23:31):

fitzgen commented on issue #14301:

Fix over in https://github.com/bytecodealliance/wasmtime/pull/14315

Wasmtime GitHub notifications bot (Sep 11 2026 at 00:37):

alexcrichton closed issue #14301:

Found by the gc_ops fuzz target and reduced to a standalone .wast, so there is no need for
libFuzzer input or cargo fuzz fmt output to paste.

wasmtime 50.0.0-dev (596675762 2026-09-08)

ref.test against a concrete struct type, on an anyref that came from
any.convert_extern of a host externref, loads the reserved
VMSharedTypeIndex (u32::MAX) out of the object's VMGcHeader and hands it
to the is_subtype libcall.

Reproduce

minimal.wast:

(module
  (type $s (sub (struct)))
  (func (export "run") (param externref) (result i32)
    local.get 0
    any.convert_extern
    ref.test (ref null $s)))

(assert_return (invoke "run" (ref.extern 1)) (i32.const 0))

$ ./target/debug/wasmtime wast minimal.wast
thread 'main' panicked at crates/environ/src/types.rs:1701:1:
assertion failed: x < u32::MAX
...
thread caused non-unwinding panic. aborting.
Aborted

Only builds with debug assertions abort.

+cc @fitzgen

<details>
<summary>Full panic output</summary>

thread 'main' (1339244) panicked at crates/environ/src/types.rs:1701:1:
assertion failed: x < u32::MAX
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

thread 'main' (1339244) panicked at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/panicking.rs:225:5:
panic in a function that cannot unwind
stack backtrace:
   0:     0x5565ff4d3501 - std[5167731717db2e51]::backtrace_rs::backtrace::libunwind::trace
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/../../backtrace/src/backtrace/libunwind.rs:117:9
   1:     0x5565ff4d3501 - std[5167731717db2e51]::backtrace_rs::backtrace::trace_unsynchronized::<std[5167731717db2e51]::sys::backtrace::_print_fmt::{closure#1}>
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/../../backtrace/src/backtrace/mod.rs:66:14
   2:     0x5565ff4d3501 - std[5167731717db2e51]::sys::backtrace::_print_fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/sys/backtrace.rs:74:9
   3:     0x5565ff4d3501 - <<std[5167731717db2e51]::sys::backtrace::BacktraceLock>::print::DisplayBacktrace as core[8c5ac2f034688f9a]::fmt::Display>::fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/sys/backtrace.rs:44:26
   4:     0x5565ff4ef29a - <core[8c5ac2f034688f9a]::fmt::rt::Argument>::fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/fmt/rt.rs:152:76
   5:     0x5565ff4ef29a - core[8c5ac2f034688f9a]::fmt::write
   6:     0x5565ff4db1fc - std[5167731717db2e51]::io::default_write_fmt::<std[5167731717db2e51]::sys::stdio::unix::Stderr>
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/io/mod.rs:626:11
   7:     0x5565ff4db1fc - <std[5167731717db2e51]::sys::stdio::unix::Stderr as std[5167731717db2e51]::io::Write>::write_fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/io/mod.rs:1730:13
   8:     0x5565ff4ad476 - <std[5167731717db2e51]::sys::backtrace::BacktraceLock>::print
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/sys/backtrace.rs:47:9
   9:     0x5565ff4ad476 - std[5167731717db2e51]::panicking::default_hook::{closure#0}
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:292:27
  10:     0x5565ff4c9181 - std[5167731717db2e51]::panicking::default_hook
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:319:9
  11:     0x5565ff4c94ab - std[5167731717db2e51]::panicking::panic_with_hook
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:815:13
  12:     0x5565ff4ad554 - std[5167731717db2e51]::panicking::panic_handler::{closure#0}
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:681:13
  13:     0x5565ff4a1aa9 - std[5167731717db2e51]::sys::backtrace::__rust_end_short_backtrace::<std[5167731717db2e51]::panicking::panic_handler::{closure#0}, !>
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/sys/backtrace.rs:182:18
  14:     0x5565ff4ae57d - __rustc[4b1ee1ef74718a7b]::rust_begin_unwind
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/std/src/panicking.rs:679:5
  15:     0x5565ff4ef93d - core[8c5ac2f034688f9a]::panicking::panic_nounwind_fmt::runtime
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/panicking.rs:122:22
  16:     0x5565ff4ef93d - core[8c5ac2f034688f9a]::panicking::panic_nounwind_fmt
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/intrinsics/mod.rs:2458:9
  17:     0x5565ff4ef8bb - core[8c5ac2f034688f9a]::panicking::panic_nounwind
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/panicking.rs:225:5
  18:     0x5565ff4efa47 - core[8c5ac2f034688f9a]::panicking::panic_cannot_unwind
                               at /rustc/88d9e12ae178fab0fb5cc050a94da85685d449ea/library/core/src/panicking.rs:337:5
  19:     0x5565fcc21790 - wasmtime[6a6622933b56cad6]::runtime::vm::libcalls::raw::is_subtype
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/libcalls.rs:115:17
  20:     0x7fcabba791ab - <unknown>
  21:     0x7fcabba7905d - <unknown>
  22:     0x7fcabba790b5 - <unknown>
  23:     0x5565fbdfa93f - <wasmtime[6a6622933b56cad6]::runtime::vm::vmcontext::VMFuncRef>::array_call_native
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/vmcontext.rs:658:13
  24:     0x5565fbdfa88f - <wasmtime[6a6622933b56cad6]::runtime::vm::vmcontext::VMFuncRef>::array_call
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/vmcontext.rs:615:30
  25:     0x5565fbe1cac9 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw::<()>::{closure#0}
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1032:13
  26:     0x5565fbd52029 - wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps::<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>::{closure#0}
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:470:32
  27:     0x5565fbd51ede - <wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::call_thread_state::CallThreadState>::with::<wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>::{closure#0}>::{closure#0}
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:716:50
  28:     0x5565fbeb638c - wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::tls::set::<bool, <wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::call_thread_state::CallThreadState>::with<wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>::{closure#0}>::{closure#0}>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:1444:13
  29:     0x5565fbd5c968 - <wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::call_thread_state::CallThreadState>::with::<wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>::{closure#0}>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:716:25
  30:     0x5565fbd4ed0d - wasmtime[6a6622933b56cad6]::runtime::vm::traphandlers::catch_traps::<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/vm/traphandlers.rs:467:59
  31:     0x5565fbe1809f - wasmtime[6a6622933b56cad6]::runtime::func::invoke_wasm_and_catch_traps::<(), <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw<()>::{closure#0}>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1475:18
  32:     0x5565fbe17268 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked_raw::<()>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1031:9
  33:     0x5565fbe16911 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_unchecked::<&mut wasmtime[6a6622933b56cad6]::runtime::store::context::StoreContextMut<()>>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1021:18
  34:     0x5565fbe16d47 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_impl_do_call::<()>
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1194:18
  35:     0x5565fbe1caf1 - <wasmtime[6a6622933b56cad6]::runtime::func::Func>::call_async::<&mut wasmtime[6a6622933b56cad6]::runtime::store::Store<()>>::{closure#0}::{closure#0}
                               at /users/khan22/bug/wasmtime/crates/wasmtime/src/runtime/func.rs:1124:45
  36:     0x5565fbd25d1d - <wasmtime[6a6622933b56cad6]::runtime::store::context::StoreContextMut<()>>::on_fiber::<core[8c5ac2f034688f9a]::result::Result<(), wasmtime_internal_core[8ad56e039512ccb9]::error::error::Error>, <wasmtime[6a6622933b56cad6]::runtime:
[message truncated]

Last updated: Sep 20 2026 at 18:08 UTC