Skip to content

Don't panic on an out-of-bounds fault in an imported shared memory - #14982

Open
yadava5 wants to merge 1 commit into
bytecodealliance:mainfrom
yadava5:fix-shared-memory-fault-panic
Open

yadava5 wants to merge 1 commit into
bytecodealliance:mainfrom
yadava5:fix-shared-memory-fault-panic

Conversation

@yadava5

@yadava5 yadava5 commented Oct 24, 2026

Copy link
Copy Markdown

Fixes #14584.

Store::wasm_fault asserts that only one instance in the store claims the faulting address. That doesn't hold for shared memories: importing one goes through SharedMemory::vmimport, which creates a single-memory instance that defines the same memory. So in the example from the issue, both $a and that instance report the fault, and the assert fires instead of the trap.

This keeps the check but only panics when the address belongs to two different memories, by comparing the wasm_address each instance reports. It doesn't compare memory_size, since a shared memory can be grown by another thread between the two reads.

I added the example from the issue as tests/misc_testsuite/threads/shared-memory-imported-oob.wast. It panics at store.rs:2061 on main and passes with this change. cargo test --test wast, cargo test --test all -- shared_memory threads traps and cargo test -p wasmtime --lib pass locally on macOS (aarch64).

I used Claude Code to reproduce the bug and test the fix locally.

`Store::wasm_fault` asserted that only one instance claims the faulting
address. Importing a shared memory through `SharedMemory::vmimport` creates
a single-memory instance that defines the same memory, so a fault in it was
claimed twice and hit the assert instead of trapping. Only panic now when
the address belongs to two different memories.

Fixes bytecodealliance#14584
@yadava5
yadava5 requested a review from a team as a code owner October 24, 2026 09:03
@yadava5
yadava5 requested review from pchickey and removed request for a team October 24, 2026 09:03
@github-actions github-actions Bot added the wasmtime:api Related to the API of the `wasmtime` crate itself label Oct 24, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

wasmtime:api Related to the API of the `wasmtime` crate itself

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Panic when a shared memory has an out-of-bounds fault

1 participant