Segfault with >120 versions on Linux

Open

#7,911 opened on Sep 22, 2025 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Stale
Tech stack: linux, wasm
Domain: compilers

Research direction

Start by running the provided wasm-opt command with bad.wasm on the latest working version 120 and a crashing version such as 124. Use the debug stack trace around BinaryenIRWriter, ValueChildIterator, and visitBlock to narrow the failure. Done means malformed or unsupported input produces an error instead of a segfault.

Written by the indexing model from the issue text.

Description

Initially, I found a segfault after upgrading kotlin, which generated a bit different WASM. Kotlin issue. However, I still would expect error messages instead of segfaults, regardless of how bad or wrong wasm is (actually unoptimised bad.wasm works OK)

I checked a few versions, and the latest working is 120. All later versions, including 124, are crashing.

Repro

Download the bad.wasm.tar.gz
Parameters I am using:

binaryen/install/bin/wasm-opt --enable-nontrapping-float-to-int --enable-gc --enable-reference-types --enable-exception-handling --enable-bulk-memory --inline-functions-with-loops --traps-never-happen --fast-math --closed-world -O3 --gufa -O3 --gufa -O3 --gufa bad.wasm -o out.wasm

Env

Archlinux, with LTS kernel: 6.12.47-1-lts #1 SMP PREEMPT_DYNAMIC

Extra info

I tried building with debug symbols, so I got stacktrace like:

                #0  0x0000000000959088 _ZN4wasm21AbstractChildIteratorINS_18ValueChildIteratorEEC2EPNS_10ExpressionE (/home/neworld/tmp/kt-bug-report/binaryen/install/bin/wasm-opt + 0x559088)
                #1  0x0000000000954be9 _ZN4wasm18ValueChildIteratorC2EPNS_10ExpressionE (/home/neworld/tmp/kt-bug-report/binaryen/install/bin/wasm-opt + 0x554be9)
                #2  0x00000000011dc5d4 _ZN4wasm16BinaryenIRWriterINS_16StackIRGeneratorEE5visitEPNS_10ExpressionE (/home/neworld/tmp/kt-bug-report/binaryen/install/bin/wasm-opt + 0xddc5d4)
                #3  0x00000000011e0cb0 _ZZN4wasm16BinaryenIRWriterINS_16StackIRGeneratorEE10visitBlockEPNS_5BlockEENKUlS4_jE_clES4_j (/home/neworld/tmp/kt-bug-report/binaryen/install/bin/wasm-opt + 0xde0cb0)
                #4  0x00000000011e100b _ZN4wasm16BinaryenIRWriterINS_16StackIRGeneratorEE10visitBlockEPNS_5BlockE (/home/neworld/tmp/kt-bug-report/binaryen/install/bin/wasm-opt + 0xde100b)
                #5  0x00000000011de5bf _ZN4wasm7VisitorINS_16BinaryenIRWriterINS_16StackIRGeneratorEEEvE5visitEPNS_10ExpressionE (/home/neworld/tmp/kt-bug-report/binaryen/install/bin/wasm-opt + 0xdde5bf)
                #6  0x00000000011dc6f7 _ZN4wasm16BinaryenIRWriterINS_16StackIRGeneratorEE5visitEPNS_10ExpressionE (/home/neworld/tmp/kt-bug-report/binaryen/install/bin/wasm-opt + 0xddc6f7)
                #7  0x00000000011dc63e _ZN4wasm16BinaryenIRWriterINS_16StackIRGeneratorEE5visitEPNS_10ExpressionE (/home/neworld/tmp/kt-bug-report/binaryen/install/bin/wasm-opt + 0xddc63e)
                #8  0x00000000011e0cb0 _ZZN4wasm16BinaryenIRWriterINS_16StackIRGeneratorEE10visitBlockEPNS_5BlockEENKUlS4_jE_clES4_j (/home/neworld/tmp/kt-bug-report/binaryen/install/bin/wasm-opt + 0xde0cb0)
                #9  0x00000000011e0de3 _ZN4wasm16BinaryenIRWriterINS_16StackIRGeneratorEE10visitBlockEPNS_5BlockE (/home/neworld/tmp/kt-bug-report/binaryen/install/bin/wasm-opt + 0xde0de3)
                #10 0x00000000011de5bf _ZN4wasm7VisitorINS_16BinaryenIRWriterINS_16StackIRGeneratorEEEvE5visitEPNS_10ExpressionE (/home/neworld/tmp/kt-bug-report/binaryen/install/bin/wasm-opt + 0xdde5bf)
                #11 0x00000000011dc6f7 _ZN4wasm16BinaryenIRWriterINS_16StackIRGeneratorEE5visitEPNS_10ExpressionE (/home/neworld/tmp/kt-bug-report/binaryen/install/bin/wasm-opt + 0xddc6f7)
                #12 0x00000000011dc63e _ZN4wasm16BinaryenIRWriterINS_16StackIRGeneratorEE5visitEPNS_10ExpressionE (/home/neworld/tmp/kt-bug-report/binaryen/install/bin/wasm-opt + 0xddc63e)

Dominant language: WebAssembly
Stars: 8.6k
Forks: 885
Avg merge: 2d 1h
Merged PRs (30d): 70

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

cmd/compile/internal/syntax: printer panics on empty var () declaration statement Open

compiler/runtime

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

golang/go#81633 · Opened Sep 21, 2026
`as-fixed.eo` keeps a minus sign on an all-zero result once `places` exceeds 15 Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

objectionary/eo#8869 · 1 comment · Opened Sep 21, 2026
RES: bound legacy format validation dimensions before rendering Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

EricSpencer00/Resilient#4824 · 1 comment · Opened Sep 21, 2026
`XmlField.find` reads attributes by position and always wraps in `Optional.of`, so a missing `access` child shifts every later attribute Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

objectionary/jeo-maven-plugin#1758 · Opened Sep 20, 2026
Templates: a REQUIREMENT parameter that is never declared in the body segfaults on REQUIRE Open

generics

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

lfortran/lfortran#13327 · Opened Sep 20, 2026

More Compilers issues