Stream: git-wasmtime

Topic: wasmtime / issue #14938 aarch64: A number of issues with ...

Wasmtime GitHub notifications bot (Oct 22 2026 at 16:47):

alexcrichton opened issue #14938:

This test:

(module
  (func (export "f") (param i32) (result i32)
    (block $default
      (block $b1
        (block $b0
          local.get 0
          br_table $b0 $b1 $default)
        i32.const 10
        return)
      i32.const 20
      return)
    i32.const 30))

(assert_return (invoke "f" (i32.const 0)) (i32.const 10))
(assert_return (invoke "f" (i32.const 5)) (i32.const 30))

fails with:

$ cargo run --target aarch64-unknown-linux-gnu -- wast -Ccranelift-use-bti br-table.wast
qemu: uncaught target signal 4 (Illegal instruction) - core dumped

This test:

(module
  (tag $e (param i32))
  (func $throw (param i32)
    local.get 0
    throw $e)
  (func (export "f") (param i32) (result i32)
    (block $h (result i32)
      (try_table (catch $e $h)
        local.get 0
        call $throw)
      unreachable)))

(assert_return (invoke "f" (i32.const 5)) (i32.const 5))

fails with:

$ cargo run --target aarch64-unknown-linux-gnu -- wast -Ccranelift-use-bti try-table.wast
qemu: uncaught target signal 4 (Illegal instruction) - core dumped

This test:

(module
  (type $t (func (param i32) (result i32)))
  (table funcref (elem $g))
  (func $g (type $t)
    local.get 0
    i32.const 1
    i32.add)
  (func (export "f") (param i32) (result i32)
    local.get 0
    i32.const 0
    return_call_indirect (type $t)))

(assert_return (invoke "f" (i32.const 5)) (i32.const 6))

fails with:

$ cargo run --target aarch64-unknown-linux-gnu -- wast -Ccranelift-use-bti return-call-indirect.wast
qemu: uncaught target signal 4 (Illegal instruction) - core dumped

This test:

(module
  (type $t (func (param i32) (result i32)))
  (table funcref (elem $g))
  (func $g (type $t)
    local.get 0
    i32.const 1
    i32.add)
  (func (export "f") (param i32) (result i32)
    local.get 0
    i32.const 0
    call_indirect (type $t)))

(assert_return (invoke "f" (i32.const 5)) (i32.const 6))

fails with:

$ cargo run --target aarch64-unknown-linux-gnu -- wast -Ccranelift-use-bti -Ccranelift-sign-return-address call-indirect.wast
qemu: uncaught target signal 4 (Illegal instruction) - core dumped

<details>
<summary>LLM summary, if useful</summary>

• br_table default: since #14826 the aarch64 jump-table sequence
  clamps the index and reaches the default block through the table, but
  visit_block_succs (inst_predicates.rs) still reports the default as
  a direct successor, so it gets no bti j. The expected output in
  filetests/isa/aarch64/bti.clif already shows this.

• try_table handlers: the unwinder resumes into try_call handler
  blocks with br x4 (crates/unwinder/src/arch/aarch64.rs), but handler
  blocks aren't treated as indirect-branch targets, so they get no
  bti j.

• return_call_indirect / return_call_ref: ReturnCallInd pins the
  target to x1 and emits br x1. The callee's bti c accepts br only
  from x16/x17.

• call_indirect with sign_return_address: tail-convention
  functions sign with the zero-modifier key (paciaz) and skip bti c,
  assuming the PACI instruction is an implicit landing pad. Only
  paciasp/pacibsp are, so every blr into a Wasm function faults.

• CLIF runtests don't catch any of this: the runner skips a target aarch64 use_bti line because cranelift-native never reports
  use_bti for the host, so runtests/br_table.clif's existing use_bti
  target never runs.

</details>

Wasmtime GitHub notifications bot (Oct 22 2026 at 16:48):

alexcrichton added the cranelift:area:aarch64 label to Issue #14938.

Wasmtime GitHub notifications bot (Oct 22 2026 at 16:48):

alexcrichton added the bug label to Issue #14938.

Wasmtime GitHub notifications bot (Oct 22 2026 at 16:48):

alexcrichton added the cranelift label to Issue #14938.

Wasmtime GitHub notifications bot (Oct 30 2026 at 06:43):

cfallin closed issue #14938:

This test:

(module
  (func (export "f") (param i32) (result i32)
    (block $default
      (block $b1
        (block $b0
          local.get 0
          br_table $b0 $b1 $default)
        i32.const 10
        return)
      i32.const 20
      return)
    i32.const 30))

(assert_return (invoke "f" (i32.const 0)) (i32.const 10))
(assert_return (invoke "f" (i32.const 5)) (i32.const 30))

fails with:

$ cargo run --target aarch64-unknown-linux-gnu -- wast -Ccranelift-use-bti br-table.wast
qemu: uncaught target signal 4 (Illegal instruction) - core dumped

This test:

(module
  (tag $e (param i32))
  (func $throw (param i32)
    local.get 0
    throw $e)
  (func (export "f") (param i32) (result i32)
    (block $h (result i32)
      (try_table (catch $e $h)
        local.get 0
        call $throw)
      unreachable)))

(assert_return (invoke "f" (i32.const 5)) (i32.const 5))

fails with:

$ cargo run --target aarch64-unknown-linux-gnu -- wast -Ccranelift-use-bti try-table.wast
qemu: uncaught target signal 4 (Illegal instruction) - core dumped

This test:

(module
  (type $t (func (param i32) (result i32)))
  (table funcref (elem $g))
  (func $g (type $t)
    local.get 0
    i32.const 1
    i32.add)
  (func (export "f") (param i32) (result i32)
    local.get 0
    i32.const 0
    return_call_indirect (type $t)))

(assert_return (invoke "f" (i32.const 5)) (i32.const 6))

fails with:

$ cargo run --target aarch64-unknown-linux-gnu -- wast -Ccranelift-use-bti return-call-indirect.wast
qemu: uncaught target signal 4 (Illegal instruction) - core dumped

This test:

(module
  (type $t (func (param i32) (result i32)))
  (table funcref (elem $g))
  (func $g (type $t)
    local.get 0
    i32.const 1
    i32.add)
  (func (export "f") (param i32) (result i32)
    local.get 0
    i32.const 0
    call_indirect (type $t)))

(assert_return (invoke "f" (i32.const 5)) (i32.const 6))

fails with:

$ cargo run --target aarch64-unknown-linux-gnu -- wast -Ccranelift-use-bti -Ccranelift-sign-return-address call-indirect.wast
qemu: uncaught target signal 4 (Illegal instruction) - core dumped

<details>
<summary>LLM summary, if useful</summary>

• br_table default: since #14826 the aarch64 jump-table sequence
  clamps the index and reaches the default block through the table, but
  visit_block_succs (inst_predicates.rs) still reports the default as
  a direct successor, so it gets no bti j. The expected output in
  filetests/isa/aarch64/bti.clif already shows this.

• try_table handlers: the unwinder resumes into try_call handler
  blocks with br x4 (crates/unwinder/src/arch/aarch64.rs), but handler
  blocks aren't treated as indirect-branch targets, so they get no
  bti j.

• return_call_indirect / return_call_ref: ReturnCallInd pins the
  target to x1 and emits br x1. The callee's bti c accepts br only
  from x16/x17.

• call_indirect with sign_return_address: tail-convention
  functions sign with the zero-modifier key (paciaz) and skip bti c,
  assuming the PACI instruction is an implicit landing pad. Only
  paciasp/pacibsp are, so every blr into a Wasm function faults.

• CLIF runtests don't catch any of this: the runner skips a target aarch64 use_bti line because cranelift-native never reports
  use_bti for the host, so runtests/br_table.clif's existing use_bti
  target never runs.

</details>

Last updated: Oct 31 2026 at 23:03 UTC