Describe the bug
A minimal WebAssembly module using exception handling, table.grow, and recursive call_indirect triggers a stack-buffer-overflow in LLVM mode.
$> wasmer -vV; rustc -vV
wasmer 7.2.0-alpha.1
binary: wasmer-cli
commit-hash: 89ce1989711550e0212592943defae9500b4e2a7
commit-date: 2026-07-06
host: x86_64-unknown-linux-gnu
CPU flags: sse2 sse3 ssse3 sse4.1 sse4.2 popcnt avx bmi bmi2 avx2 avx512dq avx512vl avx512f lzcnt fma
runtimes: Singlepass, Cranelift, LLVM
features: wasix
rustc 1.99.0-nightly (3659db0d3 2026-07-05)
binary: rustc
commit-hash: 3659db0d3e2cd634c766fcda79ed118eca31a9fd
commit-date: 2026-07-05
host: x86_64-unknown-linux-gnu
release: 1.99.0-nightly
LLVM version: 22.1.8
Steps to reproduce
- Convert the following test case to wasm:
(module
(type (func (result i32)))
(table 0 funcref)
(tag)
(func (export "main") (result i32)
block
try_table (catch 0 0)
throw 0
end
end
ref.func 0
i32.const 1
table.grow 0
call_indirect (type 0)
)
(elem declare func 0)
)
- Run:
wasmer run --llvm poc.wasm --invoke main
Actual behavior
==2257939==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7bfeb76b4ce0 at pc 0x55555fc6f863 bp 0x7fffffffcdd0 sp 0x7fffffffcdc8
READ of size 8 at 0x7bfeb76b4ce0 thread T0
#0 0x55555fc6f862 in wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0} wasmer/lib/vm/src/libcalls.rs:478:56
#1 0x55555fc6f862 in wasmer_vm::trap::traphandlers::on_host_stack::<wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0}, u32>::{closure#1} wasmer/lib/vm/src/trap/traphandlers.rs:1127:9
#2 0x55555fc6f862 in <core::panic::unwind_safe::AssertUnwindSafe<wasmer_vm::trap::traphandlers::on_host_stack<wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0}, u32>::{closure#1}> as core::ops::function::FnOnce<()>>::call_once .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/panic/unwind_safe.rs:275:9
#3 0x55555fc6f862 in std::panicking::catch_unwind::do_call::<core::panic::unwind_safe::AssertUnwindSafe<wasmer_vm::trap::traphandlers::on_host_stack<wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0}, u32>::{closure#1}>, u32> .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:576:43
#4 0x55555fc727d1 in __rust_try wasmer_vm.56cc96b25fcc60cf-cgu.05
#5 0x55555fc6ef9f in std::panicking::catch_unwind::<u32, core::panic::unwind_safe::AssertUnwindSafe<wasmer_vm::trap::traphandlers::on_host_stack<wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0}, u32>::{closure#1}>> .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:544:19
#6 0x55555fc6ef9f in std::panic::catch_unwind::<core::panic::unwind_safe::AssertUnwindSafe<wasmer_vm::trap::traphandlers::on_host_stack<wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0}, u32>::{closure#1}>, u32> .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panic.rs:359:14
#7 0x55555fc6ef9f in corosensei::unwind::catch_unwind_at_root::<u32, wasmer_vm::trap::traphandlers::on_host_stack<wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0}, u32>::{closure#1}> .cargo/registry/src/index.crates.io-1949cf8c6b5b557f/corosensei-0.3.3/src/unwind.rs:233:13
Describe the bug
A minimal WebAssembly module using exception handling, table.grow, and recursive call_indirect triggers a stack-buffer-overflow in LLVM mode.
Steps to reproduce
wasmer run --llvm poc.wasm --invoke mainActual behavior