Stream: git-wasmtime

Topic: wasmtime / issue #14333 gc_ops fuzzbug: Cranelift panics ...

view this post on Zulip Wasmtime GitHub notifications bot (Sep 14 2026 at 18:40):

khagankhan opened issue #14333:

The translator decides that an if whose parameter types differ from its result types must have an else branch. Before subtyping that was true. With GC types an if without else is valid whenever each parameter is a subtype of the matching result.

The reduced wat file: 

(module
  (type $supertype (sub (struct (field i32))))
  (type $subtype (sub $supertype (struct (field i32) (field i32))))
  (func (export "run")
    (struct.new $subtype (i32.const 7) (i32.const 8))
    i32.const 0
    if (param (ref $subtype)) (result (ref $supertype))
    end
    drop))

<details>
<summary>Stack trace or other relevant details</summary>

<!-- If you can, please paste anything that looks relevant from the failure message in the code-block below. This will help reviewers more quickly triage this report. -->

thread '<unnamed>' (323185) panicked at cranelift/codegen/src/alias_analysis.rs:1020:69:
called `Option::unwrap()` on a `None` value
stack backtrace:
   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::panicking::panic
   3: core::option::unwrap_failed
   4: <cranelift_codegen::alias_analysis::AliasAnalysis>::compute_observed_stores::{closure#0}
   5: <cranelift_codegen::alias_analysis::AliasAnalysis>::new
   6: <cranelift_codegen::context::Context>::optimize
   7: <cranelift_codegen::context::Context>::compile_stencil
   8: <cranelift_codegen::context::Context>::compile
   9: <wasmtime_internal_cranelift::compiler::FunctionCompiler>::finish_with_info
  10: <wasmtime_internal_cranelift::compiler::Compiler as wasmtime_environ::compile::InliningCompiler>::finish_compiling

</details>

view this post on Zulip Wasmtime GitHub notifications bot (Sep 14 2026 at 18:40):

khagankhan added the bug label to Issue #14333.

view this post on Zulip Wasmtime GitHub notifications bot (Sep 14 2026 at 18:40):

khagankhan added the fuzz-bug label to Issue #14333.

view this post on Zulip Wasmtime GitHub notifications bot (Sep 14 2026 at 18:42):

khagankhan edited issue #14333:

The translator decides that an if whose parameter types differ from its result types must have an else branch. Before subtyping that was true. With GC types an if without else is valid whenever each parameter is a subtype of the matching result.

wasmtime 50.0.0-dev (cb091c33c 2026-09-14)

The reduced wat file: 

(module
  (type $supertype (sub (struct (field i32))))
  (type $subtype (sub $supertype (struct (field i32) (field i32))))
  (func (export "run")
    (struct.new $subtype (i32.const 7) (i32.const 8))
    i32.const 0
    if (param (ref $subtype)) (result (ref $supertype))
    end
    drop))

<details>
<summary>Stack trace or other relevant details</summary>

<!-- If you can, please paste anything that looks relevant from the failure message in the code-block below. This will help reviewers more quickly triage this report. -->

thread '<unnamed>' (323185) panicked at cranelift/codegen/src/alias_analysis.rs:1020:69:
called `Option::unwrap()` on a `None` value
stack backtrace:
   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::panicking::panic
   3: core::option::unwrap_failed
   4: <cranelift_codegen::alias_analysis::AliasAnalysis>::compute_observed_stores::{closure#0}
   5: <cranelift_codegen::alias_analysis::AliasAnalysis>::new
   6: <cranelift_codegen::context::Context>::optimize
   7: <cranelift_codegen::context::Context>::compile_stencil
   8: <cranelift_codegen::context::Context>::compile
   9: <wasmtime_internal_cranelift::compiler::FunctionCompiler>::finish_with_info
  10: <wasmtime_internal_cranelift::compiler::Compiler as wasmtime_environ::compile::InliningCompiler>::finish_compiling

</details>

view this post on Zulip Wasmtime GitHub notifications bot (Sep 14 2026 at 18:48):

alexcrichton commented on issue #14333:

This is likely downstream of producing invalid CLIF:

$ cargo run compile foo.wat  -C cranelift-debug-verifier
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.11s
     Running `target/debug/wasmtime compile foo.wat -C cranelift-debug-verifier`
Error: Compilation error: function u0:0(i64 vmctx, i64) tail {
...
                                block4(v34: i32, v35: i64):
@003a                               v36 = iconst.i64 16
@003a                               v37 = iadd v35, v36  ; v36 = 16
@003a                               store.i32 user2 little region8 v2, v37  ; v2 = 7
@003a                               v38 = iconst.i64 20
@003a                               v39 = iadd v35, v38  ; v38 = 20
@003a                               store.i32 user2 little region8 v3, v39  ; v3 = 8
@003d                               v40 = iconst.i32 0
@003f                               brif v40, block5, block7  ; v40 = 0
;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
; error: inst46: invalid block reference block7


                                block5:
@0041                               jump block6

                                block6:
@0043                               jump block1

                                block1:
@0043                               return
}

; 1 verifier error detected (see above). Compilation aborted.

cc @fitzgen

view this post on Zulip Wasmtime GitHub notifications bot (Sep 14 2026 at 21:24):

alexcrichton closed issue #14333:

The translator decides that an if whose parameter types differ from its result types must have an else branch. Before subtyping that was true. With GC types an if without else is valid whenever each parameter is a subtype of the matching result.

wasmtime 50.0.0-dev (cb091c33c 2026-09-14)

The reduced wat file: 

(module
  (type $supertype (sub (struct (field i32))))
  (type $subtype (sub $supertype (struct (field i32) (field i32))))
  (func (export "run")
    (struct.new $subtype (i32.const 7) (i32.const 8))
    i32.const 0
    if (param (ref $subtype)) (result (ref $supertype))
    end
    drop))

<details>
<summary>Stack trace or other relevant details</summary>

<!-- If you can, please paste anything that looks relevant from the failure message in the code-block below. This will help reviewers more quickly triage this report. -->

thread '<unnamed>' (323185) panicked at cranelift/codegen/src/alias_analysis.rs:1020:69:
called `Option::unwrap()` on a `None` value
stack backtrace:
   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::panicking::panic
   3: core::option::unwrap_failed
   4: <cranelift_codegen::alias_analysis::AliasAnalysis>::compute_observed_stores::{closure#0}
   5: <cranelift_codegen::alias_analysis::AliasAnalysis>::new
   6: <cranelift_codegen::context::Context>::optimize
   7: <cranelift_codegen::context::Context>::compile_stencil
   8: <cranelift_codegen::context::Context>::compile
   9: <wasmtime_internal_cranelift::compiler::FunctionCompiler>::finish_with_info
  10: <wasmtime_internal_cranelift::compiler::Compiler as wasmtime_environ::compile::InliningCompiler>::finish_compiling

</details>

Last updated: Sep 20 2026 at 18:08 UTC