Fuzz bug with return_call_ref of imported function reference

Open

#8,031 opened on Nov 8, 2025 1 comment 0 reactions 2 assignees View on GitHub

@stevenfontanella is already working on this.

Since Jan 15, 2026.

Assessment

This issue has not been assessed yet.

Description

;; primary.wast
(module
 (global $foo (export "foo") (mut funcref) (ref.func $foo))
 (func $foo)
)

;; secondary.wast
(module
 (type $f (func))
 (import "primary" "foo" (global $gimport$0 (mut funcref)))
 (func $bar (export "bar") (type $f)
  (return_call_ref $f
    (ref.cast (ref null $f)
      (global.get $gimport$0)
    )
  )
 )
)

$ wasm-opt -all primary.wast --fuzz-exec-before --fuzz-exec-second=secondary.wast
[fuzz-exec] running second module
[fuzz-exec] calling bar
Fatal: Module::getFunction: foo does not exist

Looks like the return call interpreter machinery does not look up function references in the correct instance.

Dominant language: WebAssembly
Stars: 8.6k
Forks: 885
Avg merge: 2d 1h
Merged PRs (30d): 70

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Fuzz bug with return_call_ref of imported function reference

Assessment

Description

Contributor guide

First steps

More from WebAssembly/binaryen

Get new issues in your inbox