)]}' { "log": [ { "commit": "0086e2405dae6e86a126101d3779ded655199daf", "tree": "e8c6f07161dc05bde03b607ac2ee49d8517459ff", "parents": [ "58ddc9c7829994b4b5b9510d0ba19ad7d0d81852" ], "author": { "name": "Ilyas Mallah", "email": "github@ilyasm.dev", "time": "Wed Oct 21 01:07:34 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 01:07:34 2026" }, "message": "Exit with an error when an output file cannot be written (#2889)\n\nWhen `-o` points into a directory that doesn\u0027t exist, wasm2wat, wasm2c,\nwat-desugar and wasm-stats print \"unable to open ... for writing\" and\nstill exit 0. wat2wasm, wasm-strip and wast2json exit 1 there.\n\nA full disk goes unnoticed by all of them. A small output stays in the\nstdio buffer until the file is closed, and nothing checked `fclose`, so\n`wat2wasm test.wat -o /dev/full` exits 0. A build script then carries on\nwith an empty or truncated file.\n\nThe four tools never read the error that FileStream records, and\n`OutputBuffer::WriteToFile` ignored the return value of `fclose`. The\nfirst commit checks it there. The second adds `FileStream::Close`, which\ncloses the file and records a failed close in the stream\u0027s result, and\nthe four tools add that result to their exit status after closing.\nReading the result before the close would miss the full disk case, since\na small output only reaches the file at close.\n\nThe close error names the file. FileStream\u0027s destructor asserts that a\nfile it opened was closed with Close, so wasm2c now closes all its\nstreams when writing the C output fails.\n\nI added the four tools to bad-output-path.txt. The new\nbad-output-full-disk.txt writes to /dev/full, so it runs on Linux only.\nBoth tests fail on main with \"expected error code 1, got 0\" and pass\nwith this change.\n\nTested:\n\n- `test/run-tests.py` on x86-64 Linux with gcc (Release): 2009 passed, 0\nfailed\n- the two bad-output tests with an AddressSanitizer build (clang 18,\nDebug)" }, { "commit": "58ddc9c7829994b4b5b9510d0ba19ad7d0d81852", "tree": "aa86ea9c472bb443883dd2480b6e31a32e890dc1", "parents": [ "fa3338c6d7c02aff8dcf4331669e015ca1b85ef2" ], "author": { "name": "shravanrn", "email": "shravanrn@gmail.com", "time": "Thu Aug 27 03:51:12 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Tue Oct 20 18:33:02 2026" }, "message": "wasm2c: cleanup big-endian to use non-reversed memory\n" }, { "commit": "fa3338c6d7c02aff8dcf4331669e015ca1b85ef2", "tree": "d9cff4782a31483a43590c7518841d845b9c6543", "parents": [ "6c596c20d0fa002f35416fd372ea5ff1071bf32b" ], "author": { "name": "Rong Bao", "email": "rong.bao@csmantle.top", "time": "Wed Oct 14 15:27:18 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Tue Oct 20 16:38:25 2026" }, "message": "wasm2c: fix SIMD_FORCE_READ constraint for V-incapable RISC-V targets\n\nWhen compiling wasm2c-generated programs for V-incapable RISC-V targets,\nthe following error occurs:\n\n 111:25.21 E /var/cache/acbs/build/acbs.05foslpj/firefox-158.0/obj-riscv64-unknown-linux-gnu/media/libsoundtouch/src/rlboxsoundtouch.wasm.c:962:1: error: couldn\u0027t allocate input reg for constraint \u0027vr\u0027\n 111:25.22 E 962 | DEFINE_SIMD_LOAD_FUNC(v128_load64_zero, v128_impl_load64_zero, u64)\n 111:25.23 E | ^\n 111:25.24 E /var/cache/acbs/build/acbs.05foslpj/firefox-158.0/obj-riscv64-unknown-linux-gnu/media/libsoundtouch/src/rlboxsoundtouch.wasm.c:890:5: note: expanded from macro \u0027DEFINE_SIMD_LOAD_FUNC\u0027\n 111:25.25 E 890 | SIMD_FORCE_READ(result); \\\n 111:25.26 E | ^\n 111:25.26 E /var/cache/acbs/build/acbs.05foslpj/firefox-158.0/obj-riscv64-unknown-linux-gnu/media/libsoundtouch/src/rlboxsoundtouch.wasm.c:866:38: note: expanded from macro \u0027SIMD_FORCE_READ\u0027\n 111:25.27 E 866 | #define SIMD_FORCE_READ(var) __asm__(\"\" ::\"vr\"(var));\n 111:25.27 E | ^\n\nGate \"vr\" to V-capable RISC-V targets only and fall back to the default\npath when V is not supported.\n" }, { "commit": "6c596c20d0fa002f35416fd372ea5ff1071bf32b", "tree": "1a7e90fa9ab87bb408addff2d8327c9b509bfe50", "parents": [ "d77389b8e7488e7264164e5c68ea4a57eae7af2d" ], "author": { "name": "Michael R. Crusoe", "email": "michael.crusoe@gmail.com", "time": "Mon Sep 14 13:58:55 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Tue Oct 20 14:52:07 2026" }, "message": "Upgrade SIMDe submodule to 0.8.4-rc3\n" }, { "commit": "d77389b8e7488e7264164e5c68ea4a57eae7af2d", "tree": "1cbf1f226521a0bb95a8d77a9479a97128814180", "parents": [ "f35e8cd589429fb17cb18b45d8a04854354ebd82" ], "author": { "name": "Rong Bao", "email": "rong.bao@csmantle.top", "time": "Wed Oct 14 14:06:59 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Tue Oct 20 03:26:53 2026" }, "message": "wasm2c: fix SIMD_FORCE_READ constraint for PPC64 Altivec\n\nPer [0], \"v\" should be used for Altivec vector registers, not the\ncurrent \"f\".\n\n PowerPC and IBM RS6000\n f\n A floating point register (FPR), f0…f31.\n [...]\n v\n An Altivec vector register (VR), v0…v31.\n\nThis has caused Firefox, which vendors wasm2c, failing to link and build\non PPC64LE.\n\n[0]:\n https://gcc.gnu.org/onlinedocs/gcc/Machine-Constraints.html#:~:text\u003dPowerPC%20and%20IBM%20RS6000\n (\"6.11.3.4 Constraints for Particular Machines\")\n" }, { "commit": "f35e8cd589429fb17cb18b45d8a04854354ebd82", "tree": "791cc42bfd839e4955c42bedcf1f8d7ed334cd30", "parents": [ "6c7af198d78fff6e617a5835f6a91fd9af15a125" ], "author": { "name": "vera-rubin", "email": "322284620+vera-rubin@users.noreply.github.com", "time": "Thu Oct 15 22:45:34 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Mon Oct 19 20:38:00 2026" }, "message": "Fix memory indices on SIMD splat and zero loads\n" }, { "commit": "6c7af198d78fff6e617a5835f6a91fd9af15a125", "tree": "e73407baddea597588b4006702dcb797168a4355", "parents": [ "1e9fffd80efa901b3e4708d4ba1f0df972e63518" ], "author": { "name": "Akshat Lakhera", "email": "akshatlnct2024@gmail.com", "time": "Mon Oct 19 09:16:14 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Mon Oct 19 19:40:11 2026" }, "message": "wasm2c: fix locals in tail-call functions ending in return_call\n\nSigned-off-by: Akshat Lakhera \u003cakshatlnct2024@gmail.com\u003e\n" }, { "commit": "1e9fffd80efa901b3e4708d4ba1f0df972e63518", "tree": "9ab9def6324dc635891462d6b8900916a42dc373", "parents": [ "e5cc0c4b7c46a322cd1673ffd904c69ae8625ce3" ], "author": { "name": "Ilyas Mallah", "email": "ilyas@ilyasm.dev", "time": "Tue Oct 13 22:34:44 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 22:34:44 2026" }, "message": "wasm2c: refuse memory sizes that do not fit in size_t (#2874)\n\nFixes #2873.\n\nThis adds `u64_fits_size_t` next to `u64_mult_overflow` and checks the\nbyte length with it in the same two places. `wasm_rt_allocate_memory`\naborts, as it already does when the size overflows or `calloc` fails,\nand `memory.grow` returns -1, as it does for the other overflow cases.\nOn 64-bit hosts the check is always true.\n\nThe new test `test/wasm2c/memory-grow-4gib.txt` grows a memory to 65536\npages and checks that it stays usable whether or not the grow succeeds.\nWith `WASM2C_CFLAGS\u003d\"-m32 -fsanitize\u003daddress\"` it fails on `main` with a\nheap-use-after-free and passes with this change. On 64-bit hosts the\ngrow succeeds, so with `-DWASM_RT_USE_MMAP\u003d0` (as in the ASan CI job)\nthe test really allocates 4 GiB, which took 20 s here. If that\u0027s too\nheavy for CI I\u0027m happy to drop the test, since CI has no 32-bit job to\ncatch a regression anyway (#2369 would add one).\n\nTested:\n\n- `test/run-tests.py test/wasm2c` on x86-64\n- the new test with `-m32 -fsanitize\u003daddress`, and with\n`-fsanitize\u003daddress -DWASM_RT_USE_MMAP\u003d0` on x86-64\n- the spec `memory`, `memory_grow` and `memory64` tests and\n`address-overflow.txt` with `WASM2C_CFLAGS\u003d-m32`" }, { "commit": "e5cc0c4b7c46a322cd1673ffd904c69ae8625ce3", "tree": "79229b34d7df7d13c4dc7aa825328fb37a4292cf", "parents": [ "b835f1ce49e5803c597a0548099456d6be1d3d11" ], "author": { "name": "Aydge", "email": "aydgelee@users.noreply.github.com", "time": "Sun Oct 11 04:32:44 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 11 04:32:44 2026" }, "message": "Fix large-file I/O on Windows/MSVC (#2748)\n\nUse 64-bit file metadata and seek/tell APIs while retaining shared stdio\nread/write paths and checking file sizes before allocation. Add sparse-file\nregressions for reads above 2GB and seek/backpatch operations above 4GB." }, { "commit": "b835f1ce49e5803c597a0548099456d6be1d3d11", "tree": "ed80b17bbbf0b76a44895d7d618bf77bfcf1fb36", "parents": [ "93a552c0554392f9e26647ce216e21fd2581c566" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Mon Oct 05 15:29:51 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 05 15:29:51 2026" }, "message": "Don\u0027t discard validation failure in wasm2wat --generate-names (#2871)\n\n`ProgramMain` in wasm2wat.cc assigns the `GenerateNames` result over a\nfailed `ValidateModule` result, so with `--generate-names` an invalid\nmodule is still named, written out and reported with exit code 0, and\nrunning the spec suite\u0027s assert_invalid modules through the tools showed\n`(global f32 (local.get 0))` crashing in `ApplyNames`; generate names\nonly once validation has succeeded." }, { "commit": "93a552c0554392f9e26647ce216e21fd2581c566", "tree": "0346e2ccb35cbae7f3c1439e81210ca5b43b2ef0", "parents": [ "bfc4773da2462a9d687ac6cc0a1e8e0ee26e744a" ], "author": { "name": "Saqib Khan", "email": "saqibkhan@utexas.edu", "time": "Fri Oct 02 15:57:13 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 15:57:13 2026" }, "message": "Fix import section count when using compact imports (#2870)\n\nThe compact import section proposal encodes the import section as\n`section_2(list(imports))`, where a single entry can contain several\nimports, so the section count is the number of entries rather than the\nnumber of imports. wabt\u0027s writer and reader both used the total import\ncount, which made wabt\u0027s output unreadable by other decoders and caused\nwabt to reject conforming modules.\n\n- binary-writer: write the number of entries as the import section\ncount.\n- binary-reader: iterate over entries, keeping a separate running import\nindex; `OnImportCount` now reports the entry count.\n- wasm-objdump: count imports in the prepass so the total number of\nimports is still displayed (otherwise three existing `--enable-all` dump\ntests would print `Import[1]` followed by two imports; happy to print\nthe raw entry count and update those tests instead if preferred).\n- Updated `test/binary/compact-imports.txt` (hand-written binary, now\nwith a single entry after the compact runs) and\n`test/dump/compact-imports.txt`.\n\nNon-compact encoding is unchanged. `run-tests.py` passes.\n\nFixes #2845" }, { "commit": "bfc4773da2462a9d687ac6cc0a1e8e0ee26e744a", "tree": "1d116600468d35ea9a96dc1261e089e2c8f4b7a4", "parents": [ "10aa9878d5f4a91f776ad0366327b737f7f9c7e6" ], "author": { "name": "Zoltan Herczeg", "email": "zherczeg@inf.u-szeged.hu", "time": "Wed Sep 30 03:53:58 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 30 03:53:58 2026" }, "message": "Support empty quoted modules with annotations (#2865)" }, { "commit": "10aa9878d5f4a91f776ad0366327b737f7f9c7e6", "tree": "61e35a2468d14de441ba78060284cabf9526a00e", "parents": [ "02418f72a70466b45805891843f114c7f602eb34" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Tue Sep 29 18:45:42 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 29 18:45:42 2026" }, "message": "Add support for more fields in `linking` / `dylink.0` custom sections (#2868)\n\nAdd support for `WASM_TARGET_ARCH` in the `linking` custom section and\n`WASM_DYLINK_TARGET_ARCH` / `WASM_DYLINK_RUNTIME_PATH` in the `dylink.0`\ncustom section.\n\nSee: https://github.com/llvm/llvm-project/pull/225979" }, { "commit": "02418f72a70466b45805891843f114c7f602eb34", "tree": "e8187e386c61b652c554467cf935a7a0b2374e1b", "parents": [ "c1499564506fbd9b15e785f56d16e651b54cc7c2" ], "author": { "name": "Taylor Richberger", "email": "taylor.richberger@procern.com", "time": "Mon Sep 21 19:56:03 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 21 19:56:03 2026" }, "message": "Fix kHugeVal on AIX (#2850)\n\nHUGE_VAL and HUGE_VALF on AIX are not constexpr.\n\nFixes: #2849" }, { "commit": "c1499564506fbd9b15e785f56d16e651b54cc7c2", "tree": "9ac15040029f24c901ffcf84ac7b5e70b260a7cb", "parents": [ "7da43f2429d32ab60cf069a05951ff15e13d2e17" ], "author": { "name": "Mike Hommey", "email": "mh-github@glandium.org", "time": "Fri Sep 18 15:36:03 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 15:36:03 2026" }, "message": "Fall back to strtof/strtod on OpenBSD. (#2862)\n\nb7ad849395485e6adf9ab2bfad8226741038690d switched from strtof/strtod to\nstrtof_l/strtod_l, which are not available on OpenBSD." }, { "commit": "7da43f2429d32ab60cf069a05951ff15e13d2e17", "tree": "0c04b8487f935235d861437a1cd8258e03410865", "parents": [ "27498b245051a85a35c75b04dd102d6249d6e1d0" ], "author": { "name": "Mike Hommey", "email": "mh-github@glandium.org", "time": "Fri Sep 18 03:12:50 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 03:12:50 2026" }, "message": "Keep guard-page bounds checking enabled under clang-cl. (#2863)\n\nclang-cl doesn\u0027t define `__GNUC__`, but does accept the GCC asm\nbarriers." }, { "commit": "27498b245051a85a35c75b04dd102d6249d6e1d0", "tree": "64d568e4f49399dca755e7e71037644447230c00", "parents": [ "e197d0b7bd3fe426f5963ae540f4426a1d49e89f" ], "author": { "name": "Zoltan Herczeg", "email": "zherczeg@inf.u-szeged.hu", "time": "Thu Sep 17 02:54:41 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 02:54:41 2026" }, "message": "Improve annotation parsing (#2840)" }, { "commit": "e197d0b7bd3fe426f5963ae540f4426a1d49e89f", "tree": "9a97dd46b327e1bf62cfe3a1084de8e16a1608c8", "parents": [ "46f16644fcefc506cc35d7502acde44125f7cd09" ], "author": { "name": "sxvncry", "email": "160118530+sxvncry@users.noreply.github.com", "time": "Tue Sep 15 11:04:57 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Wed Sep 16 05:01:55 2026" }, "message": "wasm2c: fail closed when table allocation runs out of memory\n" }, { "commit": "46f16644fcefc506cc35d7502acde44125f7cd09", "tree": "fe7f7f3daf9120b33e69d80c652f98d2490d8311", "parents": [ "18a2ea3dd3b4cfacd943fd933223039c09a55e20" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Tue Sep 15 20:33:15 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 20:33:15 2026" }, "message": "[CI] Allow build_release to be manually triggered (#2860)" }, { "commit": "18a2ea3dd3b4cfacd943fd933223039c09a55e20", "tree": "98e78473b236f260a4e9b106cc50722a96195e38", "parents": [ "9e2f457432a7787c3d12fd3fbb863dadaca820f8" ], "author": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Tue Sep 15 06:45:23 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Tue Sep 15 19:30:30 2026" }, "message": "wasm2c: (Security) ensure tailcalls use initialized instance references\n" }, { "commit": "9e2f457432a7787c3d12fd3fbb863dadaca820f8", "tree": "daeb87326fb020c55b673f7e0a77599920893531", "parents": [ "ff0ef7e0009402740c805a9744c09b05be063e48" ], "author": { "name": "Kevin Moore", "email": "kevmoo@users.noreply.github.com", "time": "Tue Sep 15 18:41:01 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 18:41:01 2026" }, "message": "ci: remove unused Windows ninja install and modernize CMake invocation (#2846)\n\n- Remove the unused `choco install ninja` step on `windows-latest`\n(added in `a08df5c9` but never used since Windows CMake defaults to\nVisual Studio).\n- Modernize CMake configuration across all platforms by using `-S . -B\nout` instead of manually creating `out/` and setting `working-directory:\nout`.\n\nSplit out from #2717." }, { "commit": "ff0ef7e0009402740c805a9744c09b05be063e48", "tree": "df1e9c320fa4fd8894e95b308659f79ae5aa83e1", "parents": [ "edb5d7d3d37fe81950939a1a2ac35660dd6e76f8" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Tue Sep 15 17:14:02 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 17:14:02 2026" }, "message": "Bump version to 1.0.42 (#2859)" }, { "commit": "edb5d7d3d37fe81950939a1a2ac35660dd6e76f8", "tree": "85aa4d512373b067fab4504542aee4b57add323c", "parents": [ "505d71c2ffd6649d0ebe389ab95189220d0f3dbd" ], "author": { "name": "Zoltan Herczeg", "email": "zherczeg@inf.u-szeged.hu", "time": "Tue Sep 15 04:44:35 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 04:44:35 2026" }, "message": "Support (module instance ...) constructs (#2847)" }, { "commit": "505d71c2ffd6649d0ebe389ab95189220d0f3dbd", "tree": "6a2c4fd1a84a2358f5cda45fdcdd4cf5b6c85b2d", "parents": [ "e1e715b697e3df707cff62094560441f9bcbdf13" ], "author": { "name": "Zoltan Herczeg", "email": "zherczeg@inf.u-szeged.hu", "time": "Tue Sep 15 04:01:34 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 04:01:34 2026" }, "message": "Fix validating imported global refs (#2848)\n\nFound by George Vasiliades" }, { "commit": "e1e715b697e3df707cff62094560441f9bcbdf13", "tree": "c0400f087a6cf1fba8e7602e5cb60f243467d121", "parents": [ "a32dcf8c7b5eb2e4165110681be94b9a08dd8286" ], "author": { "name": "Kevin Moore", "email": "kevmoo@users.noreply.github.com", "time": "Mon Sep 14 20:33:45 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 20:33:45 2026" }, "message": "ci: add -y to apt-get commands and unify cross-build install (#2717)\n\n- Add `-y` to all `apt-get install` and `apt-get update` commands to\nprevent process hangs.\n- Unify `apt-get install` commands in `build-cross`.\n- Fix minor typo (`Temporatily` -\u003e `Temporarily`)." }, { "commit": "a32dcf8c7b5eb2e4165110681be94b9a08dd8286", "tree": "e16262fe2963ee7ea79b44249f49462cd8f0c3c7", "parents": [ "613f98f212e8b82f511ac0461f2db592c678bca6" ], "author": { "name": "KKiiim", "email": "jinrui_0322@163.com", "time": "Mon Sep 14 19:51:35 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 19:51:35 2026" }, "message": "[interp] Fix wasm-interp stack cleanup for tail calls (#2835)\n\nFix incorrect value-stack cleanup when lowering `return_call` and\n`return_call_indirect` in `wasm-interp`." }, { "commit": "613f98f212e8b82f511ac0461f2db592c678bca6", "tree": "a144352895fd336ed2a889fe6abc9d87ce2492f9", "parents": [ "ef1fa6e34f3338004655f4e307a561b7ff473e84" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Mon Sep 14 19:45:34 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 19:45:34 2026" }, "message": "Update ruff version from 0.15.7 -\u003e 0.16.6 (#2844)" }, { "commit": "ef1fa6e34f3338004655f4e307a561b7ff473e84", "tree": "9f7f45a08019aa4de18f5752f0d190173812c61a", "parents": [ "5be0a9f2a7fed92593b14773991f333e317867f5" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Mon Sep 14 19:34:15 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 19:34:15 2026" }, "message": "[interp] Fix operand types when tracing table.set (#2825)\n\nwasm-interp --trace, on a valid module that stores through a funcref\ntable:\n\n interp.h:596: assert `t \u003d\u003d type || type \u003d\u003d ValueType::Any\u0027 failed\n Thread::TraceSource::Pick(Index, Instr) interp.cc:2992\n Istream::Trace(...) istream.cc:909\n\ntable.set has two operands, an i32 index and a reference value, but\nopcode.def leaves the value operand Void because its type is taken from\nthe table. Pick estimates the operand count by stripping trailing Void\nparams, so it counts one instead of two and the operand-to-type mapping\nslips by one: the i32 index is handed the table element type and read\nback through Value::Get\u003cRef\u003e(). Under NDEBUG the assert is gone but the\ntrace still prints the index as a bogus funcref.\n\nSet table.set to two operands so the existing GetTableElementType\nfallback lands on the value operand and the index keeps its i32 type.\ntable.get, table.grow and table.fill already map correctly.\n\nRepro:\n\nwasm-interp --enable-all --trace --dummy-import-func -r store_fn -a\ni32:0 mod.wasm" }, { "commit": "5be0a9f2a7fed92593b14773991f333e317867f5", "tree": "c3fa44fd689ed2c527a3d67bdf95d79c7d5d59d6", "parents": [ "e177dbec10ffd9a2d6b343985b4a2938378271b5" ], "author": { "name": "shravanrn", "email": "shravanrn@gmail.com", "time": "Mon Sep 14 04:52:48 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Mon Sep 14 14:06:31 2026" }, "message": "wasm2c: Re-enable s390x CI with some tests disabled (Fix #2655)\n" }, { "commit": "e177dbec10ffd9a2d6b343985b4a2938378271b5", "tree": "08d00459662b0132de5bc7b3df79aaa1f67f90d6", "parents": [ "974221b1ef82f6393d004e5da6116f2ad3e44005" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Sun Sep 06 03:39:45 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Sep 06 03:39:45 2026" }, "message": "[cmake] Require Python 3.8 to run tests (#2843)\n\nWe already depends on Python 3.6+ since we use f-strings in test\nscripts.\n\nRequire Python 3.8+ when building tests and set `target-version` in\n`.ruff.toml` accordingly (ruff doesn\u0027t actually support versions older\nthan 3.7)." }, { "commit": "974221b1ef82f6393d004e5da6116f2ad3e44005", "tree": "4087fd2f78d14f2a68b32513fcc7d77e0f137b86", "parents": [ "4e145b34f8ebe2ae8931af3f36d85601960d0e46" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Sun Aug 30 21:09:44 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 30 21:09:44 2026" }, "message": "Reject delegate depth overflow in TypeChecker::OnDelegate (#2841)\n\nwat2wasm and wasm-validate on a try...delegate with depth 0xffffffff:\n\n $ wat2wasm bad.wat -o bad.wasm # accepted\n $ wasm-validate bad.wasm ; echo $? # 0\n\nSpotted wasm-validate passing a module that wasm-interp then hangs on.\n`TypeChecker::OnDelegate` resolves the delegate target with\n`GetLabel(depth + 1)`, as the depth counts from after the try being\nclosed. `depth` is a u32 taken straight from the module. For `depth \u003d\u003d\n0xffffffff` the `depth + 1` wraps to 0, and `GetLabel(0)` always\nsucceeds, so the bounds check never fires. `delegate 0xfffffffe` is\nstill rejected (\"invalid depth: 4294967295 (max 2)\"); only the exact\nwrap slips through.\n\nDownstream the interp builds the handler from `GetNearestTryLabel(depth\n+ 1)`, i.e. `GetNearestTryLabel(0)`, which returns the try being closed.\nThe try delegates to itself, and `Thread::DoThrow` loops on the\nself-referential handler.\n\nRejecting `depth \u003d\u003d kInvalidIndex` before the add closes both the wat\nand binary paths. Every in-range delegate is untouched." }, { "commit": "4e145b34f8ebe2ae8931af3f36d85601960d0e46", "tree": "1468ea16d22a01948245bf4f9afe0e5a18d41fa6", "parents": [ "806787e92904571c4628065277344f42c55ece05" ], "author": { "name": "Zoltan Herczeg", "email": "zherczeg@inf.u-szeged.hu", "time": "Wed Aug 26 05:57:03 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 26 05:57:03 2026" }, "message": "Support u64 limits for wasm 3.0 (#2836)" }, { "commit": "806787e92904571c4628065277344f42c55ece05", "tree": "573baea1ffd5070198356166d503a36afff773db", "parents": [ "c886b0a742903a51f481a0c6e96d163f09d4caf0" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Tue Aug 25 22:02:37 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 25 22:02:37 2026" }, "message": "Enable supported stage 5 proposals by default (#2837)\n\nEnable the following Stage 5 / finished WebAssembly proposals by\ndefault:\n- `exceptions` (Exception handling)\n- `tail-call` (Tail call)\n- `annotations` (Custom annotation syntax)\n- `memory64` (64-bit memory)\n- `multi-memory` (Multiple memories)\n- `extended-const` (Extended constant expressions)\n- `relaxed-simd` (Relaxed SIMD)\n\nUpdates default flags in `include/wabt/feature.def` and dependency\npropagation in `src/feature.cc`. Updates `--disable-*` / `--enable-*`\ncommand line flags across all tools, test runner scripts, and\n`README.md`. Regenerates man pages and documentation." }, { "commit": "c886b0a742903a51f481a0c6e96d163f09d4caf0", "tree": "fcd43ba0292ceacfeda213703e7c6bfe01193fa7", "parents": [ "2e9af63f1fab26c9c0c74e7d28062ce2bbbb31b4" ], "author": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Fri Aug 21 05:01:10 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Fri Aug 21 20:16:57 2026" }, "message": "wasm2c: missing guard force_read error with escape hatch\n" }, { "commit": "2e9af63f1fab26c9c0c74e7d28062ce2bbbb31b4", "tree": "7fefbbc6549b2831de38bda258075dddfcf3eb5b", "parents": [ "f6ae512157596660027202d26733316e869be248" ], "author": { "name": "nishad shabbir", "email": "nishadshabbir28@gmail.com", "time": "Fri Aug 21 19:52:34 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 21 19:52:34 2026" }, "message": "Don\u0027t generate a bare \"$\" from an empty export name (#2832)\n\n`wasm2wat --generate-names` produces output it can\u0027t read back when a\nmodule has an export with an empty name.\n\n```wat\n(module (func $f) (export \"\" (func $f)))\n```\n\nDisassembled with `--generate-names`:\n\n```wat\n(func $ (type $t0))\n(export \"\" (func $))\n```\n\nand assembling that back gives `error: empty identifier.`\n\nGenerated names are derived from import and export names, built as `\"$\"`\nfollowed by the name, so an empty export name leaves just the sigil.\nThis skips an empty name instead, and the item keeps whatever name the\nrest of the pass gives it — another of its export names if it has one,\notherwise the index-based name it would have had anyway.\n\nEmpty export names are legal and do turn up:\n`test/wasm2c/export-names.txt` already has one, which is where I hit\nthis.\n\nImports go through the same helper but can\u0027t reach it, because the name\nthere is always `module_name + \".\" + field_name` and so is never empty.\nI put the check in the shared helper anyway rather than in the export\npath, since it\u0027s guarding a property of the generated identifier rather\nthan anything specific to exports.\n\n### How I found it\n\nSame round-trip sweep as #2830, extended to the writer variants rather\nthan just the default one: for every module in `test/`, disassemble with\n`--fold-exprs`, `--inline-exports`, `--inline-imports`,\n`--generate-names` and `--no-debug-names` in turn, then assemble the\nresult again. `--generate-names` was 1105 of 1106, and this was the one\nfailure. It is 1106 now.\n\n### Testing\n\n`test/roundtrip/generate-empty-export-name.txt` covers a func whose only\nexport name is empty, alongside one with a usable export name so both\npaths are visible in the output. It fails without the change with the\n`empty identifier` error above.\n\nNote it deliberately does not pass `--debug-names`: with a name section\npresent the original names survive and the generator never runs, so the\ntest wouldn\u0027t exercise this at all.\n\n`roundtrip` goes from 93 to 94, and `desugar`, `typecheck`, `parse` and\nthe unit tests are unchanged.\n\n### Unrelated, while I was in there\n\nThe same sweep found `--fold-exprs` output failing to re-assemble for\ncode metadata annotations and for branch hints:\n\n```\ntest/dump/code-metadata.txt error: unexpected token \"metadata.code.test\", expected an instr.\ntest/parse/branch-hints.txt error: unexpected token (, expected ).\n```\n\nThat looks like a separate problem in how annotations are placed in\nfolded output, so I\u0027ve left it out of this PR. Happy to open an issue\nfor it if it isn\u0027t already known." }, { "commit": "f6ae512157596660027202d26733316e869be248", "tree": "e8789e5c82209a3982ff0a443446c40b5fe586a8", "parents": [ "dce62429770ea7b2795461d34b99d140e048e1f5" ], "author": { "name": "nishad shabbir", "email": "nishadshabbir28@gmail.com", "time": "Fri Aug 21 19:48:32 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 21 19:48:32 2026" }, "message": "Propagate parse errors out of instruction and expression lists (#2824)\n\n`wat2wasm`, `wast2json` and `wat-desugar` read freed memory on malformed\ntext input — #2820. The parser holds raw `TypeVector*` pointers to block\nsignatures in `resolve_type_vectors_` and only dereferences them once\nthe whole module has parsed, so a block destroyed on an error path in\nbetween leaves a dangling entry behind.\n\nThe diagnosis is @zherczeg\u0027s, from the issue thread: `ParseModuleField`\nwas returning Ok for a field that had in fact failed. Instrumenting it\nshows exactly that — the field records 8 errors and still succeeds:\n\n```\n[DBG] ParseExprList: ParseExpr failed, synchronising and returning Ok anyway\n[DBG] field -\u003e Ok, errors 0 -\u003e 8\n```\n\n`ParseInstrList` and `ParseExprList` synchronise past a bad\nsub-expression and then return `Result::Ok` unconditionally, so the\nfailure never reaches `ParseModuleField` and the rollback added in #2805\nnever runs.\n\nSo this just passes the error back. Both loops still recover and carry\non, so every error is still reported — they only remember that something\nwas dropped. `ParseModuleField` then fails as it should, and #2805\u0027s\nrollback discards the stale resolutions.\n\n## The test churn\n\n20 expected outputs get shorter, which is most of the diff: 470 lines\nremoved against 43 added.\n\nPreviously, having reported the real error, the parser would carry on\nand emit a second redundant one — nearly always `unexpected token ),\nexpected EOF` pointing at the end of the module. That no longer appears:\n\n```\n out/test/parse/expr/bad-load-align.txt:3:25: error: unexpected token align\u003dfoo, expected ).\n (module (func (i32.load align\u003dfoo (i32.const 0))))\n ^^^^^^^^^\n-out/test/parse/expr/bad-load-align.txt:3:50: error: unexpected token ), expected EOF.\n-(module (func (i32.load align\u003dfoo (i32.const 0))))\n- ^\n```\n\nI checked the direction of every one of those diffs: they only ever\nremove lines. No test gains an error and no valid module starts being\nrejected. Still, it does touch spec test expectations, so shout if you\nwould rather it were done differently.\n\n## Test\n\n`test/parse/bad-block-ref-result-discarded.txt` is the reproducer from\nthe issue. It is deliberately malformed, and it only *aborts* under a\nsanitizer, so realistically it is the asan CI jobs that would catch a\nregression rather than a normal run.\n\nFull suite is green locally against a debug ASAN/UBSAN build with all\nsubmodules checked out: 2495 tests, 0 failures.\n\nFixes #2820.\n\nCo-authored-by: nishad shabbir \u003c238154712+Nishuuzz@users.noreply.github.com\u003e" }, { "commit": "dce62429770ea7b2795461d34b99d140e048e1f5", "tree": "0f4ebb7a5ecd8333617ca4f44a2b941bd080d774", "parents": [ "3ace4bd6f9a27c8233b1fd19512fa6728f723133" ], "author": { "name": "Zoltan Herczeg", "email": "zherczeg@inf.u-szeged.hu", "time": "Thu Aug 20 05:56:12 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 05:56:12 2026" }, "message": "Support (module definition ...) constructs (#2829)\n\nRelated patch: #2666" }, { "commit": "3ace4bd6f9a27c8233b1fd19512fa6728f723133", "tree": "c5fcec6a256551369b8ed95f3777903b65c2663b", "parents": [ "9d9366ba1675e7c767ceb0df21e629c1d8a066ea" ], "author": { "name": "nishad shabbir", "email": "nishadshabbir28@gmail.com", "time": "Wed Aug 19 17:38:45 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 19 17:38:45 2026" }, "message": "Write init expressions folded so they can be parsed back (#2830)\n\n`wasm2wat` produces output it can\u0027t read back for modules that use the\nextended-const proposal.\n\nAn init expression with more than one instruction comes out like this:\n\n```wat\n(global (;1;) (mut i32) (i32.const 44\n i32.const 3\n i32.sub))\n```\n\nwhich fails to assemble:\n\n```\nerror: unexpected token i32.const, expected ).\n```\n\n`WriteInitExpr` opens a single pair of parentheses around the whole\nexpression list and then writes the instructions unfolded. For the\nordinary one-instruction case that gives `(i32.const 45)` and is fine,\nbut with several instructions the leading `(` reads as the start of a\nfolded expression and everything after it is a syntax error. Globals,\ndata offsets and elem offsets are all affected. `--fold-exprs` doesn\u0027t\nhelp, because init expressions never went through the folded writer at\nall.\n\nThis writes them with `WriteFoldedExprList` instead, which emits one\nfolded expression, valid in every position an init expression can\nappear:\n\n```wat\n(global (;1;) (mut i32) (i32.sub\n (i32.const 44)\n (i32.const 3)))\n```\n\nSingle-instruction init expressions are unaffected — those still print\nas `(i32.const 45)`, so existing expectations don\u0027t move.\n\n### How I found it\n\nI ran every `.txt` under `test/` through wat2wasm → wasm2wat → wat2wasm\nwith `--enable-all` and compared the two binaries. 1102 modules\nround-tripped byte-identically and three failed to re-assemble, all for\nthis reason: `test/dump/extended-const.txt`,\n`test/dump/invalid-data-segment-offset.txt` and\n`test/parse/module/bad-global-invalid-expr.txt`. After the change all\n1105 round-trip and the binaries match.\n\n`test/dump/extended-const.txt` already covers this module, but it\u0027s an\nobjdump test, so nothing ever fed the disassembly back to the assembler.\n\n### Testing\n\nAdded `test/roundtrip/extended-const.txt`, covering a global, a data\noffset and an elem offset with extended constant expressions. It fails\nwithout the writer change with the parse error above, and passes with\nit.\n\n`run-roundtrip.py` had no `--enable-extended-const`, which is the reason\nthe roundtrip suite couldn\u0027t have caught this in the first place, so I\nadded the flag and passed it to both tools alongside the existing ones.\n\n`test/roundtrip` goes from 92 to 93 passing, and the unit tests are\nunchanged at 135.\n\nOne caveat on my local runs: this is Windows, and a lot of the wider\nsuite can\u0027t execute here — Application Control blocks the freshly built\ntools for several directories, and the wasm2c tests need a `cl.exe` I\ndon\u0027t have. `roundtrip`, `desugar` and `typecheck` run clean, and I\nchecked that no expected output anywhere in `test/` contains the old\nunparseable shape, but I\u0027d rather flag that than imply I ran everything." }, { "commit": "9d9366ba1675e7c767ceb0df21e629c1d8a066ea", "tree": "65020e8ad00e5318135ae3c391a5306e9b16a55a", "parents": [ "6f69fe9c13dc13db72d854de086644f2494fe644" ], "author": { "name": "shravanrn", "email": "shravanrn@gmail.com", "time": "Sat Aug 15 22:36:08 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Tue Aug 18 21:14:31 2026" }, "message": "wasm2c: Save memory size locally as a perf optimization\n" }, { "commit": "6f69fe9c13dc13db72d854de086644f2494fe644", "tree": "d0ba788a546bef1f5fb13c43bf13c5d9ab902de2", "parents": [ "371dd606bd7435f1bee41b73bc74f5b66ac2cec2" ], "author": { "name": "shravanrn", "email": "shravanrn@gmail.com", "time": "Fri Aug 07 19:40:02 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Tue Aug 18 21:14:31 2026" }, "message": "wasm2c: Save memory base locally as a perf optimization\n" }, { "commit": "371dd606bd7435f1bee41b73bc74f5b66ac2cec2", "tree": "4d229f7ca41d604732aab70f4469f3909419faa4", "parents": [ "68a7ed2769b883f6bfd83e4ea6ced6837a33dae7" ], "author": { "name": "shravanrn", "email": "shravanrn@gmail.com", "time": "Fri Aug 07 19:33:44 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Tue Aug 18 21:14:31 2026" }, "message": "wasm2c: Use segue only for single unshared default page-size memories\n" }, { "commit": "68a7ed2769b883f6bfd83e4ea6ced6837a33dae7", "tree": "30028e3d2dc0be5909814c2021c94e0dde7617b0", "parents": [ "6feb2ff904fdf489cb8ed8477adc996e27d187a0" ], "author": { "name": "Gauarv Chaudhary", "email": "137998824+ANAMASGARD@users.noreply.github.com", "time": "Tue Aug 18 03:49:16 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 18 03:49:16 2026" }, "message": "wasm2c: reject contradictory imports instead of aborting (Fixes #2751)" }, { "commit": "6feb2ff904fdf489cb8ed8477adc996e27d187a0", "tree": "0406bc4d750b7d72349b5093b8f4189fa55010e8", "parents": [ "aee0a126dacabf7416c46b90d2b4fe45497cf6d5" ], "author": { "name": "shravanrn", "email": "shravanrn@gmail.com", "time": "Sun Aug 16 23:00:49 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Mon Aug 17 00:38:18 2026" }, "message": "wasm2c: Optimize force_read performance\n" }, { "commit": "aee0a126dacabf7416c46b90d2b4fe45497cf6d5", "tree": "143651330d099c155a6abe4bc13965d25c22e0e1", "parents": [ "671b860c753c8e13f17998afa54846efac992ec6" ], "author": { "name": "Gauarv Chaudhary", "email": "137998824+ANAMASGARD@users.noreply.github.com", "time": "Sun Aug 16 19:34:13 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 16 19:34:13 2026" }, "message": "interp: assert stop_on_first_error in ReadBinaryInterp (#2816)\n\n- Assert that `ReadBinaryInterp` is only used with\n`stop_on_first_error\u003dtrue`.\n- Documents that collect-all-errors mode is unsupported for the interp\nreader.\n\nFollow-up to #2812 / #2747" }, { "commit": "671b860c753c8e13f17998afa54846efac992ec6", "tree": "17ce820db8ca692fb09dbacb6b2d321a9292296e", "parents": [ "279aac0b9b640ead6fa0328769260275aee44ea6" ], "author": { "name": "nishad shabbir", "email": "nishadshabbir28@gmail.com", "time": "Thu Aug 13 15:13:38 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 13 15:13:38 2026" }, "message": "Don\u0027t abort on an empty input file (#2821)\n\nAn empty input file aborts every tool that formats errors, in any build\nwith assertions on:\n\n```console\n$ : \u003e empty.wat\n$ wat2wasm empty.wat -o /dev/null\nwat2wasm: src/lexer-source-line-finder.cc:30: wabt::LexerSourceLineFinder::LexerSourceLineFinder(...): Assertion `Succeeded(result)\u0027 failed.\nAborted\n```\n\nSame for `wast2json` and `wat-desugar`.\n\n`LexerSource::Seek` refuses to seek to the end:\n\n```cpp\nif (offset \u003c size_) {\n```\n\nOn a zero-length source that makes `Seek(0)` fail, and\n`LexerSourceLineFinder`\u0027s constructor asserts it succeeded. `Seek` has\nexactly that one caller, and `ReadRange` already clamps to `size_`, so\naccepting `offset \u003d\u003d size_` is consistent with the rest of the class —\nit\u0027s simply where an empty source starts, and reading from there yields\nnothing.\n\nWith that, the tools do what they already meant to. `wat2wasm` warns\n`empty module` and writes out an empty module, `wast2json` warns `empty\nscript`, and `wat-desugar` reports `no module in file` — all of those\npaths already existed, the assert just fired before they could run.\n\nThe test is `test/parse/zero-length-file.txt`, using `STDIN_FILE` to\npoint at a checked-in zero byte file. Writing the input inline doesn\u0027t\nwork for this: `CreateInputFile` pads the input with one newline per\nheader line so the reported line numbers line up, so the file is never\nactually empty. That\u0027s also why the existing `test/parse/empty-file.txt`\ndoesn\u0027t catch this — its input is a comment, not nothing. Without the\nfix the new test fails with `expected error code 0, got -6`.\n\nFound while fuzzing the text front end. For what it\u0027s worth,\n`fuzzers/wat2wasm_fuzzer.cc` parses but never formats errors, and the\nline finder is only constructed when formatting, so a zero-length input\nnever reaches it there — which is presumably how this survived.\n\nCo-authored-by: nishad shabbir \u003c238154712+Nishuuzz@users.noreply.github.com\u003e" }, { "commit": "279aac0b9b640ead6fa0328769260275aee44ea6", "tree": "4f871a846d82365762d27f1fb6abd3a3636eb785", "parents": [ "09cf917f1673a6e586c46fdada4ce4284aabea22" ], "author": { "name": "shravanrn", "email": "shravanrn@gmail.com", "time": "Thu Aug 13 05:03:10 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Thu Aug 13 05:46:35 2026" }, "message": "wasm2c: optimize performance of float handling\n" }, { "commit": "09cf917f1673a6e586c46fdada4ce4284aabea22", "tree": "524cb03ecdd1362b1cf3bb0edd7797ede59c8ea3", "parents": [ "afa2acc1cd6e102222dbd220bb23aea28bb45e62" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Wed Aug 12 17:23:13 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 12 17:23:13 2026" }, "message": "[interp] Fix out-of-bounds read tracing call_ref and return_call_ref (#2819)\n\n`Istream::Read` never initialises `Instr::kind` for\n`call_ref/return_call_ref` though both are emitted into the istream, so\nunder `--trace` the tracer decodes them with the previous instruction\u0027s\nkind and `Pick()` reads past the end of the value stack; give them\n`Imm_0_Op_1` (no immediate, one operand: the callee reference) like the\nother reachable opcodes." }, { "commit": "afa2acc1cd6e102222dbd220bb23aea28bb45e62", "tree": "20e9d9545b6a3e5643d46595ddf58a003a38a17d", "parents": [ "1efe42010d3a488efbad5e4a71a6fd7ef6c20b8a" ], "author": { "name": "nishad shabbir", "email": "nishadshabbir28@gmail.com", "time": "Tue Aug 11 17:42:18 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 11 17:42:18 2026" }, "message": "Assert that ReadBinaryIr is not used with skip_function_bodies (#2817)\n\n`ReadBinaryIr` fails on any module that has a function in it once\n`skip_function_bodies` is set. Reading sqlite (built with emscripten)\nboth ways:\n\n```\nskip_function_bodies\u003d0 -\u003e ok\nskip_function_bodies\u003d1 -\u003e FAILED\n function 34 missing end marker\n```\n\n34 is just its first non-imported function, so it gives up on the first\nbody it reaches.\n\n`BeginFunctionBody` pushes a label for the function, but with bodies\nskipped the reader steps straight over the body and the `end` that would\npop that label never arrives. `EndFunctionBody` then sees it still\nsitting on the stack and reports the body as missing its end marker.\n\nThe option was only ever meant for the objdump reader, which doesn\u0027t\nbuild a module, so this declares it unsupported here instead of teaching\nthe IR reader to work around it, along the lines of #2816. Nothing in\nthe tree passes it to `ReadBinaryIr` today, so nothing starts asserting.\n\nFixes #2534.\n\nCo-authored-by: nishad shabbir \u003c238154712+Nishuuzz@users.noreply.github.com\u003e" }, { "commit": "1efe42010d3a488efbad5e4a71a6fd7ef6c20b8a", "tree": "2b7c496d831643b9a7aaf048c1819b377851bc9a", "parents": [ "9dfd98d113408b7ad95336d1395f04fbd60f8997" ], "author": { "name": "nishad shabbir", "email": "nishadshabbir28@gmail.com", "time": "Tue Aug 11 17:38:56 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 11 17:38:56 2026" }, "message": "Give the tools an 8MB stack on msvc (#2815)\n\n`wat2wasm` faults on deeply nested input instead of reporting anything.\nOn Windows it exits `0xC00000FD` (`STATUS_STACK_OVERFLOW`); on Linux\nwith a small stack it segfaults. Same for `wast2json` and `wat-desugar`,\nsince they share the parser. That\u0027s #2377.\n\nThe parser is recursive descent, so every nesting level costs a few\nstack frames — measured at roughly 600 bytes per level for a gcc debug\nbuild, and msvc debug is several times that.\n\nThis started out as a nesting limit, but that was the wrong fix: real\nmodules nest deeply, because a switch lowers to a `br_table` wrapped in\none block per case. Measuring the max control depth of real toolchain\noutput:\n\n```\nwebp_enc (emscripten) 29\nresvg (wasm-pack) 180\nsqlite via sql.js (emsc) 282\nesbuild (go) 3457\n```\n\nAny limit low enough to fit msvc\u0027s 1MB default would have rejected\nsqlite and esbuild, which parse fine elsewhere today.\n\nThe stack size is what actually matters here, so that\u0027s all this does\nnow. With 8MB a debug build handles 14000 levels, and esbuild\u0027s own text\nreads back:\n\n```\nstack 1024 KB CRASH\nstack 8192 KB ok\n```\n\nThat\u0027s the whole 1.9GB `.wat` with no limit in the parser at all.\n\nThis doesn\u0027t make the recursion unbounded-safe — deep enough input will\nstill exhaust any stack. Doing that properly means not recursing at all,\nthe way wasm-tools\u0027 `wast` crate does, which is a much bigger change and\ndoesn\u0027t need to block this.\n\nFixes #2377.\n\nCo-authored-by: nishad shabbir \u003c238154712+Nishuuzz@users.noreply.github.com\u003e" }, { "commit": "9dfd98d113408b7ad95336d1395f04fbd60f8997", "tree": "69e26889831f2ae07dde907c292620e5f91ad437", "parents": [ "fcc8847f8dcadea7857f8a2b0e1972c3e5a33187" ], "author": { "name": "Gauarv Chaudhary", "email": "137998824+ANAMASGARD@users.noreply.github.com", "time": "Mon Aug 10 05:19:47 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 10 05:19:47 2026" }, "message": "Fix validation of typed select with empty result types (#2708) (#2810)\n\n- Reject `SelectT` with zero result types in the binary reader instead\nof treating it as untyped `select`\n- Reject WAT `select (result)` with an empty result list during\nvalidation\n- Add regression tests for the binary and WAT cases\n\nFixes #2708" }, { "commit": "fcc8847f8dcadea7857f8a2b0e1972c3e5a33187", "tree": "a5afe9c6a9832758f17f99d0ea2073d93094005d", "parents": [ "82932289683fe07c448e2eb11e1ae60b2d4135b8" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Mon Aug 10 00:01:57 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 10 00:01:57 2026" }, "message": "[binary-reader] Fix out-of-bounds read on invalid name sub-section (#2801)" }, { "commit": "82932289683fe07c448e2eb11e1ae60b2d4135b8", "tree": "e2baf7bf47dba01649f4aff13263f7f7eeadd99c", "parents": [ "76800b2a84659a4024db6614ba50b43c6ce64316" ], "author": { "name": "shravanrn", "email": "shravanrn@gmail.com", "time": "Sat Aug 08 19:04:11 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Sun Aug 09 04:44:16 2026" }, "message": "wasm2c: Remove unnecessary force_read in bounds check mode for performance\n" }, { "commit": "76800b2a84659a4024db6614ba50b43c6ce64316", "tree": "612d28e9ef2649a62ddd27a19e68f9caac74efcd", "parents": [ "5c51f663d50d5851f4909effef49c507dc34e215" ], "author": { "name": "xq", "email": "52606527+XX-Q@users.noreply.github.com", "time": "Sat Aug 08 18:42:46 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 08 18:42:46 2026" }, "message": "Fix float argument types in wasm-interp --run-export (#2811)\n\n`ParseFloat` and `ParseDouble` return the IEEE-754 bit pattern in an\nunsigned integer. `ParseWasmValue` passed those integers directly to\n`Value::Set`, so debug builds tagged `f32`/`f64` command-line arguments\nas `i32`/`i64`. The interpreter then failed its value-stack type check\nas soon as the exported function consumed an argument.\n\nBitcast the parsed bits to the corresponding floating-point type before\nstoring them. This preserves both the value and the interpreter type\ntag.\n\nA CLI regression test covers both `f32` and `f64` arguments.\n\nFixes: #2664" }, { "commit": "5c51f663d50d5851f4909effef49c507dc34e215", "tree": "7b13c8a8aae9bb6b589fb51e25b8987f4102d2a7", "parents": [ "2902099f4f25ec6378281fc1e94b989e851571d6" ], "author": { "name": "shravanrn", "email": "shravanrn@gmail.com", "time": "Thu Aug 06 23:13:40 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Sat Aug 08 09:00:19 2026" }, "message": "wasm2c: Optimize call indirect code footprint for better performance\n" }, { "commit": "2902099f4f25ec6378281fc1e94b989e851571d6", "tree": "285c50a10fdd4c9a25c4712fe6231e0193ef7ef3", "parents": [ "cd490a12d331a04478482bd71425970d9d936e45" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Thu Aug 06 15:35:49 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 06 15:35:49 2026" }, "message": "Fix use-after-free resolving reference type names in wast-parser (#2805)\n\ndrop the deferred reference-type resolutions a module field registered\nbefore it failed to parse, otherwise ParseModuleFieldList dereferences\npointers into a field that was destroyed instead of appended." }, { "commit": "cd490a12d331a04478482bd71425970d9d936e45", "tree": "541cfe4d202b0c107c2e5d94d7e5f61f97f573c0", "parents": [ "ec6f4970e12c0e1f31e52b0686e8d3d17c33081f" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Mon Aug 03 16:46:21 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 03 16:46:21 2026" }, "message": "Fix memory64 offset truncation in the interp istream (#2799)\n\nRunning a memory64 module under wasm-interp, `i64.load\noffset\u003d0x1_0000_0000` from address 0 returned 0 instead of trapping. A\nlarge dynamic address (5 GiB) does trap, so the static offset was the\nsuspect.\n\n1. OnLoadExpr hands the memarg offset over as an `Address` (u64), but\n`istream_.Emit(opcode, memidx, offset)` resolved to `Emit(Opcode, u32,\nu32)` and narrowed it to 32 bits.\n2. For an i64-indexed memory a static offset of 2^32 or more is then\nlost, so an access whose effective address is out of bounds wraps to a\nsmall in-range offset and reads or writes a valid location rather than\ntrapping.\n\nCarried the offset as u64 the whole way: added\n`imm_index_offset`/`imm_index_offset_lane` immediates and `Emit(Opcode,\nu32, u64)` overloads, widened the four `Imm_Index_Offset_*` decode\ngroups, the load/store/atomic/simd-lane handlers and the disassembler.\n32-bit memories are untouched since the offset always fits u32.\nRegression test added under test/interp." }, { "commit": "ec6f4970e12c0e1f31e52b0686e8d3d17c33081f", "tree": "6011f52d1e5d12fa0fe6acd88166746f70354854", "parents": [ "f8e541312b30acf0d36fbf23b36d71a017a371b9" ], "author": { "name": "shravanrn", "email": "shravanrn@gmail.com", "time": "Sat Aug 01 06:04:44 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Sat Aug 01 18:31:59 2026" }, "message": "wasm2c: Extend segue to simd and unshared atomics\n" }, { "commit": "f8e541312b30acf0d36fbf23b36d71a017a371b9", "tree": "e3f2f568a545afe8e4659761726dd3c40ae96187", "parents": [ "0ef5bd9a261407d4469a849e7ff41f34c889c45e" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Wed Jul 29 19:07:49 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 29 19:07:49 2026" }, "message": "Fix out-of-bounds read when tracing global.set and table ops (#2802)\n\nASan, `spectest-interp --trace` on a module that imports a global and\nalso defines one:\n\n\u003d\u003d73766\u003d\u003dERROR: AddressSanitizer: heap-buffer-overflow on address\n0x60e0000002a4\n READ of size 8 at 0x60e0000002a4 thread T0\n#1 Thread::TraceSource::GetGlobalType(unsigned int) interp.cc:3022\n #2 Thread::TraceSource::Pick(unsigned int, Instr) interp.cc:2954\n #3 Istream::Trace(...) istream.cc:887\n0x60e0000002a4 is located 12 bytes after 152-byte region\n[0x60e000000200,0x60e000000298)\n\nNoticed it while reading the trace helpers. `ModuleDesc::globals` and\n`ModuleDesc::tables` hold only the defined entries, imports live in\n`ModuleDesc::imports`. But the `global.set`/`table.*` immediate is the\nmodule-level index, which counts imports first. One imported global plus\none defined global is already enough to run off the end.\n`GetTableElementType` has the same shape at interp.cc:3026, reached from\n`table.grow` and `table.fill`.\n\nThe garbage `ValueType` that comes back then decides how the operand\n`Value` is read, so a debug build aborts on the `CheckType` assert in\ninterp.h and a release build prints an arbitrary reference index.\n\nBoth immediates now resolve against the instance, which is what the\n`GlobalSet`, `DoTableGrow` and `DoTableFill` handlers already do.\nRegression test added under test/interp." }, { "commit": "0ef5bd9a261407d4469a849e7ff41f34c889c45e", "tree": "0ba13df3766ed8b2b52a8cee125f472e28534ffd", "parents": [ "11602da5423eb9c7517311ed01917ea231594170" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Mon Jul 20 17:07:50 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 20 17:07:50 2026" }, "message": "[interp] Pop memory.copy/table.copy length using the minimum index type (#2800)\n\nA valid module doing a mixed-width `table.copy` aborts wasm-interp in a\ndebug build:\n\n$ wasm-interp --enable-memory64 --enable-multi-memory --run-all-exports\nt.wasm\nAssertion failed: (t \u003d\u003d type || type \u003d\u003d ValueType::Any), function\nCheckType, file interp.h, line 596.\n\nThe module copies from an i64-indexed table into an i32-indexed one\n(`table.copy $t32 $t64`). Found it running the memory64 tests under\n`--run-all-exports`.\n\n`DoTableCopy`/`DoMemoryCopy` pop the length operand with the source\u0027s\nindex type (`PopPtr(table_src)`/`PopPtr(mem_src)`). But the length\u0027s\ntype is the minimum of the two index types, not the source\u0027s, so for a\n64-bit source into a 32-bit destination the length is i32 while the\ninterpreter reads it as i64. `TypeChecker::OnMemoryCopy`/`OnTableCopy`\nalready spell out the min rule; the runtime side just didn\u0027t follow it.\n\nDebug builds trip the type assertion. In release the read only gives the\nright answer because the `Value` union happens to be zero-initialised.\n\nPop the length as u64 only when both memories/tables are 64-bit.\nSame-width copies are byte-identical. Regression test added under\ntest/interp." }, { "commit": "11602da5423eb9c7517311ed01917ea231594170", "tree": "644ef3a111b31113d8f847c0c61fb112dc434bed", "parents": [ "f794a59d915d608bbeab5a85823a7482bf12aac8" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Fri Jul 17 18:03:59 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 17 18:03:59 2026" }, "message": "Fix out-of-bounds type stack read after rethrow in c-writer (#2798)\n\nwasm2c on a valid exceptions module, ASan/debug build:\n\nAssertion failed: (index \u003c type_stack_.size()), function Write, file\nc-writer.cc, line 1246.\n\nWorked backwards from the StackVar read. The rethrow case in\n`Write(const ExprList\u0026)` ends in `break`, so the loop carries on and\nemits the instructions after it. The validator has already marked those\nunreachable (`OnRethrow` makes the stack polymorphic), so a valid module\ncan put operations there that pop operands which are not really on the\nstack. StackVar then underflows `type_stack_` and reads off the end.\nRelease builds drop the assert and take the out-of-bounds read;\n`DropTypes` does an out-of-bounds erase on the same tail.\n\nbr, br_table, return, unreachable, throw, throw_ref and the return_call\nfamily all return here to stop walking the list. rethrow was the one\nthat fell through, so it now does the same.\n\nRepro: `(func try nop catch_all rethrow 0 i32.store end)` assembled with\n`--enable-exceptions`, then run through wasm2c." }, { "commit": "f794a59d915d608bbeab5a85823a7482bf12aac8", "tree": "2242ee58f39649f12156d0513fe08f782378a183", "parents": [ "2a8dc8be6575f75e51e41d7a3835ee0a4541d1f5" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Tue Jul 14 16:26:02 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 14 16:26:02 2026" }, "message": "Avoid out-of-bounds imports read in wasm_instance_new (#2797)\n\nASan, instantiating a 2-import module through the wasm C API with a\n1-element imports vector:\n\n \u003d\u003dERROR: AddressSanitizer: heap-buffer-overflow\n READ of size 8 ... in wasm_instance_new interp-wasm-c-api.cc:746\n 0 bytes after 8-byte region [...] (the caller\u0027s imports array)\n\nSpotted while running modules through libwasm with a fixed imports list.\n`wasm_instance_new` copies the imports into a `RefVec` by looping `i`\nover the module\u0027s declared import count and reading `imports-\u003edata[i]`.\nNothing checks the caller actually supplied that many, so a module whose\nimport section declares more imports than the embedder passes reads past\nthe end of the imports array and then derefs the wild pointer through\n`-\u003eI-\u003eself()`.\n\n`Instance::Instantiate` already rejects a short list with a \"not enough\nimports!\" trap, but it runs after this loop, so the over-read happens\nfirst. Bounding the loop by `imports-\u003esize` lets the short case fall\nthrough to that existing trap instead. Valid and over-supplied lists\nbuild the same `RefVec` as before." }, { "commit": "2a8dc8be6575f75e51e41d7a3835ee0a4541d1f5", "tree": "2d5dff68edc333c48169221fbacd9635db120952", "parents": [ "33328a02b9d4ef3d5c008009795a7b621f03cad0" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Mon Jul 13 16:06:58 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 13 16:06:58 2026" }, "message": "Fix out-of-bounds write in MakeTypeBindingReverseMapping (#2796)\n\nASan, release build, `wasm2wat` on a crafted module:\n\n \u003d\u003d…\u003d\u003dERROR: AddressSanitizer: heap-buffer-overflow\n #0 wabt::MakeTypeBindingReverseMapping(...) ir.cc\n #1 wabt::ApplyNames(wabt::Module*)\n #2 ProgramMain\n ... located 1535 bytes after 24-byte region\n\nFound while going over the name-section handlers. The local subsection\nstores a (local index, name) pair per entry. `OnLocalNameLocalCount`\nchecks the entry count against the function\u0027s param+local count, but the\nper-entry local index in `OnLocalName` is never range-checked before it\nbecomes a `Binding`. `MakeTypeBindingReverseMapping` sizes the reverse\nmap to that local count and writes each name at `binding.index`, guarded\nonly by an `assert`. A name whose index sits past the function\u0027s locals\nwrites off the end of the vector: a debug build trips the assert, a\nrelease build corrupts the heap. Reached from an untrusted `.wasm`\nthrough `wasm2wat` and `wasm2c` (both call `ApplyNames` and read debug\nnames by default), on an otherwise valid module.\n\nSkip entries that land outside the mapping. Valid modules only name real\nlocals, so their output does not change. The added test names local\nindex 5 of a one-param function; before the fix `wasm2wat` aborts, after\nit prints the module with the stray name dropped." }, { "commit": "33328a02b9d4ef3d5c008009795a7b621f03cad0", "tree": "2591c8f32ebfd612ef0174bc526935168fea34c2", "parents": [ "f93b9215d74627b4e8ae8bf94e804438c6fff2d9" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Sat Jul 11 16:41:03 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jul 11 16:41:03 2026" }, "message": "Fix out-of-bounds read in BinaryReaderLogging::WriteIndent (#2795)\n\nFound with ASan while feeding fuzz-style modules to `wasm-objdump\n--debug`:\n\n \u003d\u003dERROR: AddressSanitizer: global-buffer-overflow\n READ of size 144 at 0x... thread T0\n#5 wabt::BinaryReaderLogging::WriteIndent() binary-reader-logging.cc:75\n #6 wabt::BinaryReaderLogging::BeginGenericCustomSection(...)\n 0x... is located 0 bytes after global variable\n \u0027WriteIndent()::s_indent\u0027 ... of size 143\n\nWriteIndent emits the indent from a fixed 142-space buffer in chunks.\nThe loop writes full blocks and shrinks `i`; the leftover write then\npassed `indent_`, the whole width, rather than `i`. Once the indent\ngrows past the buffer that leftover write runs off the end.\n`WatWriter::WriteIndent` uses the same loop but writes the leftover\ncount, so this was the odd one out.\n\nHow the indent gets that big: it rises by two on every section Begin. A\ncustom `name` section whose sub-section size runs past the section end\nfails after `BeginNamesSection`, and objdump reads with\n`stop_on_first_error` and `fail_on_custom_section_error` both off, so\nthe matching End callbacks never run and the indent leaks a little per\nbad section. Enough of them and it passes the buffer during the prepass\nlogging.\n\nRegression test added under test/binary-reader; it overruns without the\nchange and is clean with it." }, { "commit": "f93b9215d74627b4e8ae8bf94e804438c6fff2d9", "tree": "6f5b051421ca90fbae6823f88bd79d722ae28dbb", "parents": [ "fb047130174be8ffad5718182ac83c2f5dcb45be" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Thu Jul 09 17:24:21 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 09 17:24:21 2026" }, "message": "Fix operand arity of v128.storeN_lane in GetExprArity (#2764)\n\nFound this fuzzing wasm-decompile under a debug build: a valid module\nwhose only instruction is v128.store8_lane aborts on the value-stack\nassert in decompiler-ast.h Construct.\n\n1. GetExprArity groups SimdLoadLane and SimdStoreLane together and\nreports both as {2, 1}.\n2. store_lane pops the address and the vector and pushes nothing, so its\nreal effect is {2, 0}; the spare result throws value_stack_depth out by\none.\n\nThe decompiler has since been removed, but GetExprArity still drives the\nfolded wat writer, where the phantom result is equally observable:\nwasm2wat --fold-exprs folds the store into the next value consumer and\nstrands the value beneath it. Split the case so SimdStoreLane returns\n{2, 0} and SimdLoadLane keeps {2, 1}. A reduced repro is added under\ntest/roundtrip." }, { "commit": "fb047130174be8ffad5718182ac83c2f5dcb45be", "tree": "1f5851614af279cd30ac3d79f5baa4e22bf15d0e", "parents": [ "814c8e326ef778a4d1b51610dbf69e25e3db3701" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Wed Jul 08 23:56:49 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 08 23:56:49 2026" }, "message": "Check memory64 addr+offset overflow in wasm2c store/atomic/simd ops (#2790)\n\nComparing wasm2c output either side of 4bedf7c (\"check address + offset\naddition for memory64\"):\n\n // load (fixed in 4bedf7c)\n i64_load(\u0026M0, (u64)checked_add_u64(var_j0, 16u));\n // store (still unchecked)\n i64_store(\u0026M0, (u64)(var_j0) + 16, var_j1);\n\nThat commit only converted `CWriter::Write(const LoadExpr\u0026)`. For an i64\nmemory the store still adds the static offset with a wrapping `+`, and\nso do the SIMD lane/splat/zero and atomic emitters.\n\nHow I hit it: memory64 module, `i64.store offset\u003d16` at address\n`0xFFFFFFFFFFFFFFF0`. The sum overflows u64 to 0, the generated\n`RANGE_CHECK` sees an in-range address, and the write lands at guest\naddress 0. Per the spec that access should trap; the load form already\ndoes after 4bedf7c.\n\nApplied the same `checked_add_u64` guard to `StoreExpr`,\n`SimdLoadLaneExpr`, `SimdStoreLaneExpr`, `LoadSplatExpr`,\n`LoadZeroExpr`, `AtomicLoadExpr`, `AtomicStoreExpr`, `AtomicRmwExpr` and\n`AtomicRmwCmpxchgExpr` for `is_64` memories. The 32-bit output is byte\nfor byte unchanged. The wasm2c spec tests (memory64, threads, simd)\nstill pass." }, { "commit": "814c8e326ef778a4d1b51610dbf69e25e3db3701", "tree": "8ae603defcb7d6df8610da56035af0a29f956442", "parents": [ "40417c0d9f3f79b07d94dde6fe551460b01f3fbb" ], "author": { "name": "lexi-nadia", "email": "lexinadia@google.com", "time": "Wed Jul 08 20:21:04 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 08 20:21:04 2026" }, "message": "Fix WABT_PRINTF_TYPE_CODE to correctly handle INT_MIN (#2792)\n\nThis fixes a fuzzer-discovered edge case: the result of std::abs(INT_MIN) is undefined behavior. To work around this, we now convert the value to int64_t." }, { "commit": "40417c0d9f3f79b07d94dde6fe551460b01f3fbb", "tree": "2b2e6cb69e9b7556ed669ae8e8c6126916da5c2e", "parents": [ "6b85d94cb60d64aff01bf7e6d7aa44e9c69e2146" ], "author": { "name": "lexi-nadia", "email": "lexinadia@google.com", "time": "Wed Jul 08 18:35:21 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 08 18:35:21 2026" }, "message": "Add WABT_USE annotations for Result values only used in assertions (#2793)" }, { "commit": "6b85d94cb60d64aff01bf7e6d7aa44e9c69e2146", "tree": "3c3f5a800cb39829561b1ec4931321440046a921", "parents": [ "f4908362bd398b31853c4754664a2ea01ff31966" ], "author": { "name": "lexi-nadia", "email": "lexinadia@google.com", "time": "Wed Jul 08 04:47:30 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 08 04:47:30 2026" }, "message": "Mark Result as [[nodiscard]] and fix associated errors (#2791)\n\nThis CL fixes a fuzzer error caused by unintentionally ignoring a\nfailure. Instead of just fixing the one case, I figured I\u0027d fix them\nall.\n\nIn a handful of cases, I wasn\u0027t sure how errors should be propagated.\nPlease feel free to suggest improvements!" }, { "commit": "f4908362bd398b31853c4754664a2ea01ff31966", "tree": "22e2da9ee814beb4dc1c8d75b4807a218505c24b", "parents": [ "146b6f3dbdcf745d5a2a21d0577fcc4350f02384" ], "author": { "name": "lexi-nadia", "email": "me@lexibromfield.com", "time": "Tue Jul 07 19:27:53 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 07 19:27:53 2026" }, "message": "Zero-init an InitInst to avoid accessing unintialized memory (#2789)" }, { "commit": "146b6f3dbdcf745d5a2a21d0577fcc4350f02384", "tree": "7ffe2cb4a2a7e59a29b97e12c9e39d53174f97cd", "parents": [ "52a5fed56973288161f82be15249e3ff7b2a3eed" ], "author": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Sun Jul 05 22:20:16 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Mon Jul 06 19:21:48 2026" }, "message": "wasm2c: Move to O3 optimizations for wasm2c spec compliance tests\n" }, { "commit": "52a5fed56973288161f82be15249e3ff7b2a3eed", "tree": "775e41c65796c8ac5cd13978e869a761cf0b5ab1", "parents": [ "4bedf7c2638dffeafdf063afb0c2deaa13482cfc" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Mon Jul 06 19:06:37 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 06 19:06:37 2026" }, "message": "Bounds-check function index in name section local handlers (#2787)\n\nASAN, calling `ReadBinaryIr` with `read_debug_names\u003dtrue` and\n`stop_on_first_error\u003dfalse` on a crafted module:\n\n binary-reader-ir.cc:1721: AddressSanitizer: container-overflow\n READ of size 8 in BinaryReaderIR::OnLocalNameLocalCount\n\nFound while going over the name-section handlers.\n`OnLocalNameLocalCount` and `OnLocalName` index\n`module_-\u003efuncs[func_index]` using the function index taken from the\nname section\u0027s local subsection. The reader only checks `function_index\n\u003c NumTotalFuncs()`, i.e. the declared count `num_func_imports_ +\nnum_function_signatures_`. With `stop_on_first_error` off, a truncated\nfunction section (declares two funcs, but the second signature LEB runs\npast the section end) leaves `funcs` one short of that count, so a local\nname for the missing function reads past the vector.\n`OnLocalNameLocalCount` had a debug-only assert; `OnLocalName` had no\ncheck at all.\n\nEvery sibling handler here already does the `index \u003e\u003d size()` check, and\n`OnFunctionBodyCount` already guards this same `stop_on_first_error`\ncase for the code path. Added the matching check to both local-name\nhandlers, plus a regression test." }, { "commit": "4bedf7c2638dffeafdf063afb0c2deaa13482cfc", "tree": "d1c4cf362c755de53decbfeb282741113e841dcb", "parents": [ "58cf9ff2a8e19e5291a24b7d6394fd51c9d0e0d6" ], "author": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Fri Jul 03 02:53:14 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Fri Jul 03 22:02:46 2026" }, "message": "wasm2c: (Security) fix to check address + offset addition for memory64\n" }, { "commit": "58cf9ff2a8e19e5291a24b7d6394fd51c9d0e0d6", "tree": "45a60269f244cc7317d67bda38b927e119f43680", "parents": [ "bf48b8c5ae364b195281398a33a11cdd7fad23d0" ], "author": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Fri Jul 03 02:27:51 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Fri Jul 03 21:17:51 2026" }, "message": "wasm2c: fix minor errors in atomic ops implementation\n" }, { "commit": "bf48b8c5ae364b195281398a33a11cdd7fad23d0", "tree": "7ad27db6b371e99c209930f56d78088b18b1531d", "parents": [ "e62f23cc829c9c846d0b6985e80c5fb22930a331" ], "author": { "name": "Aizal Khan", "email": "aizumusheer2@gmail.com", "time": "Fri Jul 03 16:44:05 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Fri Jul 03 17:27:25 2026" }, "message": "wasm2c: guard wasm_rt_allocate_memory size overflow and alloc failure\n" }, { "commit": "e62f23cc829c9c846d0b6985e80c5fb22930a331", "tree": "842b73c1cf850ce80ab7a00a5029dc520a3990d2", "parents": [ "1c7bca930694427af1f3076010a1cbc9297b1030" ], "author": { "name": "Valentino Contreras", "email": "valentinocontrerast@gmail.com", "time": "Fri Jul 03 17:06:41 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 17:06:41 2026" }, "message": "[validator] Allow call_indirect/return_call_indirect table elements to be subtypes of funcref (#2780)\n\nThis PR resolves an issue where the validator rejects valid WebAssembly\nmodules using typed function references (such as `(ref null $sig)`) with\n`call_indirect` and `return_call_indirect`.\nCurrently, `SharedValidator` performs a strict equality check\n(`table_type.element !\u003d Type::FuncRef`), which rejects valid subtypes of\n`funcref` in indirect calls.\n**Changes:**\n- Replaced the strict equality check in `src/shared-validator.cc` with\n`typechecker_.CheckType` to correctly check for subtypes of `funcref`.\n- Handled out-of-range table index checks to maintain compatibility with\nexisting spec test outputs.\n\nFixes: #2523" }, { "commit": "1c7bca930694427af1f3076010a1cbc9297b1030", "tree": "56deb2f6a067138d3ee88ddf2f93123467d8d0dd", "parents": [ "d75ec31583006d9385d942545e49f76bbc2d2fc1" ], "author": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Fri Jul 03 02:12:14 2026" }, "committer": { "name": "Shravan Narayan", "email": "shravanrn@gmail.com", "time": "Fri Jul 03 07:10:11 2026" }, "message": "wasm2c: (Security) fix runtime overflows when running Wasm modules with memory64\n" }, { "commit": "d75ec31583006d9385d942545e49f76bbc2d2fc1", "tree": "1e1167ff4b59018212882ffc446313bb96cd36bd", "parents": [ "984f7f30003a9048eaeb49c1962493cb8992d896" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Mon Jun 29 22:34:43 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 29 22:34:43 2026" }, "message": "Fix DecodeInvalidOpcode for 9-bit opcode codes (#2781)\n\nWhen MAX_OPCODE_BITS was increased to 9, DecodeInvalidOpcode still used\na hardcoded 0xff mask when unpacking the invalid opcode code. This\ncaused any invalid opcode with a code \u003e\u003d 0x100 (such as unsupported SIMD\nopcodes) to be truncated to 8 bits when reported in error messages.\n\nUse ((1 \u003c\u003c MAX_OPCODE_BITS) - 1) instead of 0xff so that 9-bit opcode\ncodes are correctly preserved when reporting invalid opcodes.\n\nSee #2779" }, { "commit": "984f7f30003a9048eaeb49c1962493cb8992d896", "tree": "7860ad92e600cc37664e978cfa2fd92a0f38261f", "parents": [ "23b62e9665fa96fa6d94e9e08adb3bc5ce1f3a34" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Mon Jun 29 16:41:48 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 29 16:41:48 2026" }, "message": "[cpp20] Modernize binary reader and writer APIs to use std::span (#2775)\n\nReplace legacy raw pointer and size pairs with std::span\u003cconst uint8_t\u003e\n(aliased to `ByteSpan`) across WABT\u0027s binary reader interfaces, writer\nstreams, parser callbacks, and public entry points.\n\nThis greatly improves type safety, simplifies call sites (allowing\nvectors\nand arrays to be passed directly), and aligns WABT with modern C++20\nstandards.\n\nHighlights:\n- Fixes a performance bug in Stream::WriteData where passing std::vector\n accidentally triggered a full copy-by-value of the vector\u0027s contents.\n The template overload now correctly accepts std::span (zero-copy).\n- Simplifies various writing call sites (e.g. in binary-writer,\nc-writer,\n and wasm-strip) by passing vectors directly or leveraging subspan." }, { "commit": "23b62e9665fa96fa6d94e9e08adb3bc5ce1f3a34", "tree": "fd616be9f962654843c01914402491c58e638bec", "parents": [ "2b2fb60ff9c3a87c47480c0010536f172e851d9c" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Sat Jun 27 06:25:39 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jun 27 06:25:39 2026" }, "message": "[interp] Stop on first error in the binary reader fuzzer (#2778)\n\nThe interp binary reader is only meant to read valid modules. Every\n`ReadBinaryInterp` caller runs with `stop_on_first_error\u003dtrue` except\n`read_binary_interp_fuzzer.cc`, which passed `false`.\n\nIn collect-all-errors mode the `SharedValidator` keeps counting\ndeclarations the reader has already rejected. For example a function\nwhose type index is out of range: `OnFunction` skips the append, but the\nvalidator still counts it. So the reader\u0027s `func_types_`/`module_.funcs`\nvectors and the validator\u0027s counts drift apart, and later callbacks\nindex past the end (`BeginFunctionBody`, `OnExport`,\n`OnReturnCallExpr`).\n\nPer the review, rather than adding reader-side guards for a mode the\ninterp reader was never meant to support, this stops the fuzzer on the\nfirst error like every other caller, so the reader is no longer driven\nover invalid modules." }, { "commit": "2b2fb60ff9c3a87c47480c0010536f172e851d9c", "tree": "9012df803d199be408ac77784aa7487e5d6428cb", "parents": [ "3baa26374aa356e766ce71bb4631918f5a87923b" ], "author": { "name": "Zoltan Herczeg", "email": "zherczeg@inf.u-szeged.hu", "time": "Thu Jun 25 08:43:13 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 25 08:43:13 2026" }, "message": "Remove ReadLeb128 type argument (#2776)" }, { "commit": "3baa26374aa356e766ce71bb4631918f5a87923b", "tree": "2cdc6811ad6d7259ecdb4bd676b800e5ac6d7a23", "parents": [ "5d0a3a7b6a9ab1c846275db74d09855011fb5e36" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Wed Jun 24 14:56:45 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 24 14:56:45 2026" }, "message": "Avoid out-of-bounds section_starts_ read on invalid reloc index (#2777)\n\nUBSan, `wasm-objdump -x` on a crafted module:\n\nbinary-reader-objdump.cc:69:12: runtime error: index\n18446744073709551615 out of bounds for type \u0027const Offset[14]\u0027\n#0 BinaryReaderObjdumpBase::GetSectionStart binary-reader-objdump.cc:69\n #1 BinaryReaderObjdump::OnReloc binary-reader-objdump.cc:2176\n\nThe input is a `reloc.*` custom section whose section index points past\nthe last section. The base `OnRelocCount` spots that, sets\n`reloc_section_` to `BinarySection::Invalid` (`~0`) and returns `Error`\nto abort the section. The details-mode override dropped that result and\nreturned `Ok`, so `ReadRelocSection` carried on into `OnReloc`, where\n`GetSectionStart(reloc_section_)` reads `section_starts_[(size_t)-1]`.\n\n`Result` is not `[[nodiscard]]`, so the dropped error built clean.\nPropagating it with `CHECK_RESULT` rejects the bad index the same way\nthe other reader modes already do.\n\n`bad-relocs.txt` used a zero relocation count, so it never reached\n`OnReloc`; gave it one entry so it covers the read." }, { "commit": "5d0a3a7b6a9ab1c846275db74d09855011fb5e36", "tree": "fe8f29256a4c96f2c2391e6c0629a39e69e403de", "parents": [ "274f26bbf391433d94767a3504aa5f9d8cd74aff" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Wed Jun 24 06:08:36 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 24 06:08:36 2026" }, "message": "[wasm2c] Write float constants independent of the host locale (#2768)\n\nNoticed while running wasm2c with the embedder\u0027s locale set to de_DE,\nwhere LC_NUMERIC makes the radix \u0027,\u0027. The constant writer produced:\n\n instance-\u003ew2c_g0 \u003d 1,5;\n\nsnprintf(\"%.9g\"/\"%.17g\") in CWriter::Write(const Const\u0026) takes the radix\nfrom the active locale, but the emitted C must use \u0027.\u0027. The comma is\neither a compile error or, in argument/initialiser position, a comma\nexpression that quietly drops the fractional part. The f64 path is\nworse: the following strchr(buf, \u0027.\u0027) no longer finds the radix, so it\nalso appends \".0\" and writes 1,5.0.\n\nThe .wat writer sidesteps this by emitting hex floats, and the parsing\ndirection was already made locale-independent in literal.cc. This is the\noutput side. The fix formats as before, then rewrites the locale\u0027s radix\nback to \u0027.\u0027, so the generated C is byte-identical regardless of the\nlocale the caller set. Output under the C locale is unchanged.\n\nAdded a unit test that writes a module with f32/f64 constants under a\ncomma locale and checks the result uses \u0027.\u0027. It skips when no comma\nlocale is installed, matching the existing parser test." }, { "commit": "274f26bbf391433d94767a3504aa5f9d8cd74aff", "tree": "87405c8123c66dbae4e108bcf80c0b354c537228", "parents": [ "256515849f292997a0e39048018fa04141a47a56" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Wed Jun 24 04:38:19 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 24 04:38:19 2026" }, "message": "Use C++20 standard bit utilities and std::bit_cast. NFC (#2773)\n\n- Replace custom Clz, Ctz, and Popcount implementations in config.h.in\nwith standard templates using std::countl_zero, std::countr_zero, and\nstd::popcount from \u003cbit\u003e.\n- Redefine wabt::Bitcast to use std::bit_cast.\n- This removes a significant amount of compiler-specific boilerplate." }, { "commit": "256515849f292997a0e39048018fa04141a47a56", "tree": "0deb55511706d7722cd57912f035517678865800", "parents": [ "deeb6f34d243f40877c49cc8b73bdf75c7f28592" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Wed Jun 24 03:15:33 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 24 03:15:33 2026" }, "message": "Add -Wno-gnu-folding-constant when compiling c api examples (#2774)\n\nI\u0027m not sure why this starting showing up as a failure on the\nmacos-latest build. I\u0027m guess it was some kind of system updated that\ngive us a newer version of clang.\n\nI\u0027m also not sure why `-std\u003dgnu11` wasn\u0027t enough to enable this\nextension." }, { "commit": "deeb6f34d243f40877c49cc8b73bdf75c7f28592", "tree": "b85ccd3a5eec911f33ecf3e30861bda26d815c96", "parents": [ "1bccd720008840a40eb9a6c8051f27390e414206" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Tue Jun 23 18:24:08 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 23 18:24:08 2026" }, "message": "Update from C++17 to C++20 (#2772)\n\nBinaryen did this a while back in\nhttps://github.com/WebAssembly/binaryen/pull/8218.\n\nThere we a couple of issue related to building on macOS 13.2.1 but I\ndon\u0027t think we need to support building on such old versions of macOS\nhere. We still support deploying to macOS 10.14 via\nCMAKE_OSX_DEPLOYMENT_TARGET.\n\nUse std::string::starts_with and std::string_view::starts_with in\nvarious places now that C++20 is available.\n\nAlso, adopt `.contains()` for std::map, std::set, and their unordered\ncounterparts to replace verbose find/end and count checks." }, { "commit": "1bccd720008840a40eb9a6c8051f27390e414206", "tree": "5bd64eb59325d3abed79fa2e3490d61a31bb6db8", "parents": [ "f87a3ad2de1525ca71c20f70a20fcb51f1157d8e" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Tue Jun 23 16:55:31 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 23 16:55:31 2026" }, "message": "[binary-reader] Templatize LEB reading functions. NFC (#2771)" }, { "commit": "f87a3ad2de1525ca71c20f70a20fcb51f1157d8e", "tree": "17e10bfceda9d64ecc7e07d26299957b4d2b2c28", "parents": [ "2304811313bc496fe49054181693c518dbfef4d6" ], "author": { "name": "Zoltan Herczeg", "email": "zherczeg@inf.u-szeged.hu", "time": "Tue Jun 23 08:29:49 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 23 08:29:49 2026" }, "message": "Support 64 bit limits for tables (#2767)" }, { "commit": "2304811313bc496fe49054181693c518dbfef4d6", "tree": "c79c5d24741ab843293b1f74821f56fc31fb3a81", "parents": [ "3cd556a4f81b3d6fb616d53396109e47b36a8be4" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Mon Jun 22 22:24:57 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 22 22:24:57 2026" }, "message": "Remove wasm-decompile (#2769)\n\nThis tools was unmainatined and acting mostly active as source of fuzzer\nbugs." }, { "commit": "3cd556a4f81b3d6fb616d53396109e47b36a8be4", "tree": "6463b5c7a00c27e2b12550e2f7a085dc7541837d", "parents": [ "4c6951d0c5658276727a0fe1bb352dd9953e7847" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Mon Jun 22 20:39:33 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 22 20:39:33 2026" }, "message": "Add ruff python linter. NFC (#2770)" }, { "commit": "4c6951d0c5658276727a0fe1bb352dd9953e7847", "tree": "0aed078bd9c835a3cfd8d5da6750fab2d4e1694a", "parents": [ "51f0020d2f70bb0fada6c4a2ef9af9b841d48006" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Mon Jun 22 17:04:28 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 22 17:04:28 2026" }, "message": "Avoid front() on an empty element expression in the validator (#2765)\n\nThe validator picks each element expression\u0027s diagnostic location with\nelem_expr.front().loc, which dereferences a null list head when the\nelement expression is empty (an init expr that is only the trailing end\nbyte, which the binary reader accepts), so fall back to the segment\nlocation and let the existing constant-expression check reject it with\nthe same type-mismatch error already produced for an empty global or\ndata init expr; reachable from untrusted .wasm via wasm-validate,\nwasm2wat and wasm-decompile, which all validate by default." }, { "commit": "51f0020d2f70bb0fada6c4a2ef9af9b841d48006", "tree": "d0bef18e9f097b7a2ae68a534cb9cc7c2aace8f8", "parents": [ "80b6582e395fde2adc1f62728950d9ed760e5af1" ], "author": { "name": "Sam Clegg", "email": "sbc@chromium.org", "time": "Mon Jun 22 09:07:48 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 22 09:07:48 2026" }, "message": "Update man pages and html docs (#2763)\n\nThis was automated via the new scripts/update-manpages.py" }, { "commit": "80b6582e395fde2adc1f62728950d9ed760e5af1", "tree": "230595967a365454d70e1a12371945471c6afa59", "parents": [ "f42ead6ca363617f01dcf7d36a9008f35b872adb" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Fri Jun 19 17:21:42 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jun 19 17:21:42 2026" }, "message": "Avoid Var::name() on function-level branches in decompiler (#2762)\n\nFound while fuzzing wasm-decompile.\n\n Assertion failed: (is_name()), function name, file ir.h, line 82.\n\nA branch whose target is the function\u0027s implicit outermost label is left\nas an index by the name resolution passes, since there is no block label\nto attach to it. DecompileExpr then called Var::name() on that index\nvar. ir.h keeps index_ and name_ in a union, so this reads the inactive\nstd::string member; with NDEBUG the assert is gone and it dereferences a\ngarbage pointer instead.\n\nSmallest repro, decompiles to a return:\n\n (func (block (loop (br 2))))\n\nbr_if and br_table with a function-level target reach the same path.\nRouted the three branch sites through a helper that emits return when\nthe target is unnamed." }, { "commit": "f42ead6ca363617f01dcf7d36a9008f35b872adb", "tree": "7e0ca137817a5d00c61c0f1c69533cf1a2712463", "parents": [ "4421c6cf73592dc3dfde95d380df1697bc5f116b" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Thu Jun 18 17:41:03 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 18 17:41:03 2026" }, "message": "Avoid string_view underflow in ParseCodeMetadataAnnotation (#2761)\n\nASAN, `wat2wasm --enable-annotations` on a `(@custom ...)` sat inside a\nfunction body:\n\n ERROR: AddressSanitizer: heap-buffer-overflow READ of size 8\n #5 std::__string_view_hash::operator()(std::string_view)\n #9 wabt::BinaryWriter::WriteExpr() binary-writer.cc:1189\n #11 wabt::BinaryWriter::WriteFunc() binary-writer.cc:1229\n\n`ParseCodeMetadataAnnotation` strips the `metadata.code.` prefix with\n`remove_prefix(14)` and assumes it is always there. `ParseInstrList`\nhands it every `(@...)` annotation in an instruction list, and `Peek`\nadmits the bare `(@custom ...)` token because that spelling is\nmeaningful at module scope. On the 6-byte `custom` text\n`remove_prefix(14)` underflows the view length to ~2^64 and walks the\ndata pointer past the token. The `CodeMetadataExpr` then keeps a name\nwhose pointer and size are both rubbish. Nothing trips until the binary\nwriter hashes that name as a map key, which is where ASAN fires.\n\nThe binary reader already guards the matching strip with\n`find(\"metadata.code.\") \u003d\u003d 0` in binary-reader.cc; the parser never got\nit. Reject annotations without the prefix.\n\nRepro:\n\n (module\n (func\n (@custom \"x\")))\n\nTurned up fuzzing wat2wasm with annotations enabled." }, { "commit": "4421c6cf73592dc3dfde95d380df1697bc5f116b", "tree": "6bd03c5aa58fac637d516351532838a42e884b6b", "parents": [ "71acc6da51158a2e08e1db37ec62909431370bc6" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Wed Jun 17 16:10:08 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 17 16:10:08 2026" }, "message": "[interp] Use u64 table operands so out-of-range table64 indices trap (#2760)\n\nOn a table declared with the i64 index type, an index past the end of\nthe table does not trap as it should:\n\n $ wasm-interp --enable-memory64 --run-all-exports t.wasm\n get_oob() \u003d\u003e funcref:0\n\nThe table has 10 slots and the index was `(i64.const 0x1_0000_0003)`.\nThat is out of bounds, but it read slot 3.\n\ntable.get/set/fill/copy/init/grow pop their operands as u64 for an i64\ntable (PopPtr), then pass them to Table::Get/Set/Fill/Copy/Init/Grow,\nwhich take u32. The high half is dropped, so any index in [2^32, 2^32 +\nsize) wraps to an in-range slot and the bounds check passes. table.set\noverwrites a live entry that way, and table.grow truncates a delta above\n2^32 and reports success instead of failing.\n\nMemory already takes u64 throughout for memory64, so this widens the\nTable side to match and rejects a grow delta that does not fit in u32.\nBehaviour for i32 tables is byte-identical. Added an interp test\ncovering the wrap window." }, { "commit": "71acc6da51158a2e08e1db37ec62909431370bc6", "tree": "1cea15a498140b607fceb567c22cfd125c98a9d7", "parents": [ "e6053b83c88f51b6cf06668205716a4f0c14be17" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Tue Jun 16 17:48:15 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 16 17:48:15 2026" }, "message": "Avoid unbounded alloca in FloatParser::ParseFloat (#2754)\n\nParseFloat sizes alloca() by the literal length, so a multi-megabyte\nfloat constant in untrusted .wat text overflows the stack; use a heap\nbuffer instead." }, { "commit": "e6053b83c88f51b6cf06668205716a4f0c14be17", "tree": "5dc9f08a5ef32074b8eb1e0684e832552525a729", "parents": [ "68db1c1b214fa71b5566264a6ceeb6c18b3e842a" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Mon Jun 15 17:06:43 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 15 17:06:43 2026" }, "message": "[wasm2c] Use locale-independent ctype in GenerateHeaderGuard (#2759)\n\nThe file already defines internal_isalpha/isdigit/isalnum/ishexdigit on\nuint8_t for this exact reason (the comment above them spells it out),\nused throughout Mangle. GenerateHeaderGuard was the lone holdout. Routed\nit through internal_isalnum plus a matching internal_toupper. Guards for\nASCII header names come out byte-identical." }, { "commit": "68db1c1b214fa71b5566264a6ceeb6c18b3e842a", "tree": "0799ad9365a15d7980f23cdc3deb9368c9ca3947", "parents": [ "b7ad849395485e6adf9ab2bfad8226741038690d" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Sat Jun 13 17:30:13 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jun 13 17:30:13 2026" }, "message": "[wasm-decompile] Avoid out-of-range shift in load/store rewrite (#2758)\n\nUBSan, decompiling a module that addresses memory as (base + (index \u003c\u003c\nn)):\n\nsrc/decompiler.cc:325:21: runtime error: shift exponent 64 is too large\nfor 64-bit type \u0027unsigned long long\u0027\n #0 wabt::Decompiler::LoadStore(...) decompiler.cc:325\n #1 wabt::Decompiler::DecompileExpr(...) decompiler.cc:489\n\nThe load/store printer recognises that address shape and tries to\nrewrite it to base[index], testing 1ULL \u003c\u003c n against the access\nalignment. n is the i32.const operand of the i32.shl, read straight from\nthe module. i32.shl masks its shift amount at runtime, so n is otherwise\nunconstrained; n \u003e\u003d 64 pushes the exponent past the width of the type\nand the shift is undefined.\n\nBounding n \u003c 64 before the shift loses no real match, since the\nalignment it is compared against is always a small power of two. The\nunmatched shape then prints verbatim, the same as a mismatched shift\nalready does.\n\nRepro is a load of (local 0 + (local 1 \u003c\u003c 64)): UBSan aborts at\ndecompiler.cc:325 before, decompiles to (a + (b \u003c\u003c 64))[0]:int after.\nCovered by the loadstore decompile test." }, { "commit": "b7ad849395485e6adf9ab2bfad8226741038690d", "tree": "c9830a42f4a3798d16bcb2b544dce4baa1bc9ee7", "parents": [ "435b7da6260124d7ab65724f21fcc47512a7f915" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Wed Jun 10 06:54:35 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 10 06:54:35 2026" }, "message": "Parse decimal float literals independent system locale (#2757)" }, { "commit": "435b7da6260124d7ab65724f21fcc47512a7f915", "tree": "b9a93a03baaf441ed56e7bfe115cbedfbdacc73f", "parents": [ "2d84a9980efe4bc107f2504c912d5c6ced7192c9" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Tue Jun 09 17:53:23 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 09 17:53:23 2026" }, "message": "[wasm2c] Avoid size_t overflow in wasm_rt_grow table reallocation (#2756)\n\nOn a 32-bit (ILP32) build, growing a funcref table in `wasm_rt_grow`:\n\n new_elems \u003d 230000000 (\u003c\u003d table-\u003emax_size)\n new_elems * sizeof \u003d 4600000000 bytes (computed as uint64_t)\n realloc() size_t arg \u003d 305032704 bytes (truncated to 32-bit)\n\n`new_elems` is a `uint64_t` but only bounded by `table-\u003emax_size`, which\ncan be `UINT32_MAX`. The element is a multi-pointer struct, so the byte\ncount crosses 2^32 long before `new_elems` does. The product is then\nnarrowed to `realloc`\u0027s `size_t` parameter, so the reallocation is far\ntoo small. The loop right after writes `new_elems` elements into it. A\nguest `table.grow` with a large delta on a table with a large max\nreaches this.\n\nFound while reading the table path looking for the realloc-side\nequivalent of the recent wasi size fix. `calloc` in `wasm_rt_allocate`\nis safe because it overflows-checks its two operands; the grow path does\nthe multiply itself and hands the result straight to `realloc`, which\ndoes not.\n\nReject the grow when the byte size would not fit in `size_t`, before the\nrealloc. No effect on 64-bit. The shared include covers the funcref,\nexternref and exnref variants." }, { "commit": "2d84a9980efe4bc107f2504c912d5c6ced7192c9", "tree": "04d274e90ac23298185a1a02eac05af0e695c5a7", "parents": [ "9bbc21ef33932532fbee97025eecb5b5a6fa4d7f" ], "author": { "name": "aizu-m", "email": "aizumusheer2@gmail.com", "time": "Fri Jun 05 16:27:09 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jun 05 16:27:09 2026" }, "message": "Use unsigned shift in GetAlignment to avoid signed overflow (#2755)\n\nReading the two binary readers side by side, the load/store alignment\nimmediate gets widened differently:\n\n binary-reader-ir.cc: 1ull \u003c\u003c alignment_log2\n binary-reader-interp.cc: 1 \u003c\u003c alignment_log2\n\nThe interp form shifts a signed int. CheckAlignment only rejects\nalignment_log2 \u003e\u003d 32, so a load or store in an untrusted module can\ncarry alignment_log2 \u003d\u003d 31, and 1 \u003c\u003c 31 on int is signed overflow.\nSwitching the literal to 1u makes the shift unsigned; the returned value\nis unchanged." } ], "next": "9bbc21ef33932532fbee97025eecb5b5a6fa4d7f" }