Describe the bug
A module exercising varied tag shapes (empty, i32, f64, i32×i32 params) together with catch_ref/throw_ref rethrow and nested try_table handlers causes a stack-buffer-underflow inside RawVecInner::finish_grow, reached while growing the store's Vec during exception-object allocation.
wasmer -vV; rustc -vV
Output of the command:
wasmer 7.2.0-alpha.1
binary: wasmer-cli
commit-hash: 89ce1989711550e0212592943defae9500b4e2a7
commit-date: 2026-07-06
host: x86_64-unknown-linux-gnu
CPU flags: sse2 sse3 ssse3 sse4.1 sse4.2 popcnt avx bmi bmi2 avx2 avx512dq avx512vl avx512f lzcnt fma
runtimes: Singlepass, Cranelift, LLVM
features: wasix
rustc 1.99.0-nightly (3659db0d3 2026-07-05)
binary: rustc
commit-hash: 3659db0d3e2cd634c766fcda79ed118eca31a9fd
commit-date: 2026-07-05
host: x86_64-unknown-linux-gnu
release: 1.99.0-nightly
LLVM version: 22.1.8
Steps to reproduce
Testcase:
test.wasm.txt
test.wat.txt
- Rename
test.wasm.txt to test.wasm
- Run the command to observe sanitizer crash:
wasmer run --llvm test.wasm --invoke main
Actual behavior
Observed the following crash trace:
==3088712==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7bfeb769ae90 at pc 0x55555fc986dd bp 0x7bfeb769ae40 sp 0x7bfeb769ae38
WRITE of size 8 at 0x7bfeb769ae90 thread T0
#0 0x55555fc986dc in <alloc::raw_vec::RawVecInner>::finish_grow (.llvm.18205967998706808563) .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/raw_vec/mod.rs:565:27
#1 0x55555fc9811b in <alloc::raw_vec::RawVecInner>::grow_amortized .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/raw_vec/mod.rs:529:33
#2 0x55555fc9811b in <alloc::raw_vec::RawVecInner>::grow_one .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/raw_vec/mod.rs:493:41
#3 0x55555fc9811b in <alloc::raw_vec::RawVec<wasmer_vm::exception::VMExceptionObj>>::grow_one .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/raw_vec/mod.rs:188:29
#4 0x55555fc62c9b in <alloc::vec::Vec<wasmer_vm::exception::VMExceptionObj>>::push_mut .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/vec/mod.rs:1039:22
#5 0x55555fc62c9b in <alloc::vec::Vec<wasmer_vm::exception::VMExceptionObj>>::push .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/vec/mod.rs:1002:22
#6 0x55555fc62c9b in <wasmer_vm::store::InternalStoreHandle<wasmer_vm::exception::VMExceptionObj>>::new wasmer/lib/vm/src/store.rs:274:14
#7 0x55555fc7f708 in wasmer_vm_alloc_exception wasmer/lib/vm/src/libcalls.rs:754:18
Describe the bug
A module exercising varied tag shapes (empty, i32, f64, i32×i32 params) together with catch_ref/throw_ref rethrow and nested try_table handlers causes a stack-buffer-underflow inside
RawVecInner::finish_grow, reached while growing the store's Vec during exception-object allocation.wasmer -vV; rustc -vV Output of the command: wasmer 7.2.0-alpha.1 binary: wasmer-cli commit-hash: 89ce1989711550e0212592943defae9500b4e2a7 commit-date: 2026-07-06 host: x86_64-unknown-linux-gnu CPU flags: sse2 sse3 ssse3 sse4.1 sse4.2 popcnt avx bmi bmi2 avx2 avx512dq avx512vl avx512f lzcnt fma runtimes: Singlepass, Cranelift, LLVM features: wasix rustc 1.99.0-nightly (3659db0d3 2026-07-05) binary: rustc commit-hash: 3659db0d3e2cd634c766fcda79ed118eca31a9fd commit-date: 2026-07-05 host: x86_64-unknown-linux-gnu release: 1.99.0-nightly LLVM version: 22.1.8Steps to reproduce
Testcase:
test.wasm.txt
test.wat.txt
test.wasm.txttotest.wasmwasmer run --llvm test.wasm --invoke mainActual behavior
Observed the following crash trace: