alexcrichton

Cranelift x64: compile-time panic when an overflow op with a sinkable load operand is lowered twice

• Audit date: 2026-09-11
• Wasmtime commit audited: 2be5e3a62b (main, "Drop cached compiler contexts between modules/components (#14314)")
• Platform: Linux x86_64 (7.0.0-30-generic), also reproduces for target x86_64 cross-compilation from any host
• Auditor: Claude Opus 5 (1M context), Claude Code
• Introduced by: 34dded7f50 "Cranelift: add opportunistic value defs, use for uadd_overflow + brif folds (#14228)" (2026-08-31), extended to umul_overflow/smul_overflow in d445cd7e07 (#14254). The follow-up fix 84dbb9ffdc (#14272) fixed the "flag used multiple times" case but not this one.
• Severity: compile-time panic (assert!, fires in release builds too) on valid CLIF. Not a miscompile. Not currently reachable from WebAssembly via Wasmtime as far as I can determine (see "Reachability" below), so this is a Cranelift robustness bug rather than a Wasmtime security issue.

alexcrichton

diff --git a/build.rs b/build.rs
index 9a0ee3a..2bc39a8 100644
--- a/build.rs
+++ b/build.rs
@@ -1,7 +1,7 @@
 #![deny(warnings)]
 
 use {
-    anyhow::{Context, Result, anyhow, bail},
+    anyhow::{anyhow, bail, Context, Result},

alexcrichton

diff --git a/Cargo.lock b/Cargo.lock
index dd05b9a..66ae230 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1888,14 +1888,15 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.26.0"
+version = "0.27.2"

alexcrichton

This document describes the "Basic" C ABI for WebAssembly. As mentioned in README, it's not the only possible C ABI. It is the ABI that the clang/LLVM WebAssembly backend is currently using, and any other C or C++ compiler wishing to be ABI-compatible with it.

Versioning and Machine interface

The current version of this ABI is 1.

This ABI is designed to work with Release 1.0 of the WebAssembly Specification. It does not require any

alexcrichton

This document describes the "Basic" C ABI for WebAssembly. As mentioned in README, it's not the only possible C ABI. It is the ABI that the clang/LLVM WebAssembly backend is currently using, and any other C or C++ compiler wishing to be ABI-compatible with it.

Versioning and Machine interface

The current version of this ABI is 1.

This ABI is designed to work with Release 1.0 of the WebAssembly Specification. It does not require any

alexcrichton

use std::ptr::NonNull;

#[derive(Default)]
struct Heap {
    data: Data,
}
#[derive(Default)]
struct Data {
    a: u32,
}

alexcrichton

name	auditor
description	Guide for performing code audits of Wasmtime when searching for bugs, vulnerabilities, and other issues. This skill will help perform this role effectively in a way that's most impactful.

Auditor Skill Guide

alexcrichton

;; Run test case

test run
set opt_level=speed
target x86_64

function %my_fn(i128 sext, i16x8, f64, f32x4, i64x2, i128 sext, i32 sext, i64 sext, f32, i16 uext, i64x2, i16 sext, i32x4, i8 sext, i8x16, i8x16) -> i128 sext, i16x8, f64, f32x4, f32x4, i64x2, i8 uext, i8, f64x2, i32 uext, f32, i128 uext, i32 uext, i64 sext, f32, i16 uext fast {
    ss0 = explicit_slot 65, align = 1024
    ss1 = explicit_slot 62, align = 1024
    ss2 = explicit_slot 16, align = 16

alexcrichton

diff --git a/fuzz/src/roundtrip_wit.rs b/fuzz/src/roundtrip_wit.rs
index 480093bb6..9279296a7 100644
--- a/fuzz/src/roundtrip_wit.rs
+++ b/fuzz/src/roundtrip_wit.rs
@@ -79,8 +79,11 @@ pub fn run(u: &mut Unstructured<'_>) -> Result<()> {
 
         // Decode what was just created and record it later for testing merging
         // worlds together.
-        let (_, decoded) = wit_component::metadata::decode(&dummy).unwrap();
-        decoded_bindgens.push((decoded, dummy, world.name.clone()));

alexcrichton

diff --git a/fuzz/src/roundtrip_wit.rs b/fuzz/src/roundtrip_wit.rs
index 480093bb6..9593a31e1 100644
--- a/fuzz/src/roundtrip_wit.rs
+++ b/fuzz/src/roundtrip_wit.rs
@@ -79,8 +79,11 @@ pub fn run(u: &mut Unstructured<'_>) -> Result<()> {
 
         // Decode what was just created and record it later for testing merging
         // worlds together.
-        let (_, decoded) = wit_component::metadata::decode(&dummy).unwrap();
-        decoded_bindgens.push((decoded, dummy, world.name.clone()));