wasm-split fuzzing and reusing an existing Table

Open

#8,106 opened on Dec 8, 2025 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Needs clarification
Activity status: Stale
Tech stack: cpp, wasm
Domain: compilers, testing-qa

Research direction

Read src/ir/module-splitting.cpp at lines 186-191 and reproduce the reported fuzzer case with the shown wat. Trace how the existing table, call_indirects, and secondary-module element writes interact; done means ordinary table.set operations no longer overwrite wasm-split function pointers and the third export does not trap.

Written by the indexing model from the issue text.

Description

I seem to recall we discussed using a new Table in wasm-split, when reference types is set? Atm it looks like we reuse the table if one exists:

https://github.com/WebAssembly/binaryen/blob/28e849b91fab4fb697c27206b7d6f2c090e3519c/src/ir/module-splitting.cpp#L186-L191

The fuzzer errored on this, with exports like these:

 (func $0
 )
 (func $1
  (table.set $0
   (i32.const 1)
   (ref.null nofunc)
  )
  (unreachable)
 )
 (func $2
 )

After splitting these three out, we end up with call_indirects in all three in the primary module. The secondary module's elem writes the proper function pointers, but when we call $1 we trample some of that data, leading to the third export trapping. That is, it is unsafe to use the table for normal stuff and also wasm-split stuff, without the two being aware of each other.

cc @tlively @aheejin

Dominant language: WebAssembly
Stars: 8.6k
Forks: 885
Avg merge: 2d 1h
Merged PRs (30d): 70

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

`EoCodec` stores a `float` as a `double`, so a signaling-NaN float constant comes back with different bits Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

objectionary/jeo-maven-plugin#1774 · Opened Sep 21, 2026
cmd/compile/internal/syntax: printer panics on empty var () declaration statement Open

compiler/runtime

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

golang/go#81633 · Opened Sep 21, 2026
Missing constant folding rules for `toUIntX` functions Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

leanprover/lean4#15255 · Opened Sep 21, 2026
[fx] Generated code for `operator.pow(-2, x)` is `-2 ** x`, which Python evaluates as `-(2 ** x)`: `GraphModule.forward` returns the wrong sign (`Interpreter` is correct); reachable from `torch.compile(dynamic=True)` via `(-1) ** x.shape[0]` Open

bot-triaged module: correctness (silent) module: fx release triage triage review

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

pytorch/pytorch#197894 · 1 comment · Opened Sep 21, 2026
Grammar Gap: activated › effect clause › {self} deals damage equal to its power to target creature Open

area:mechanics ready-for-agent

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

fil-donadoni/tolaria#4317 · Opened Sep 21, 2026

More Compilers issues