binaryen icon indicating copy to clipboard operation
binaryen copied to clipboard

Fuzz bug with return_call_ref of imported function reference

Open tlively opened this issue 3 months ago • 0 comments

;; primary.wast
(module
 (global $foo (export "foo") (mut funcref) (ref.func $foo))
 (func $foo)
)
;; secondary.wast
(module
 (type $f (func))
 (import "primary" "foo" (global $gimport$0 (mut funcref)))
 (func $bar (export "bar") (type $f)
  (return_call_ref $f
    (ref.cast (ref null $f)
      (global.get $gimport$0)
    )
  )
 )
)
$ wasm-opt -all primary.wast --fuzz-exec-before --fuzz-exec-second=secondary.wast
[fuzz-exec] running second module
[fuzz-exec] calling bar
Fatal: Module::getFunction: foo does not exist

Looks like the return call interpreter machinery does not look up function references in the correct instance.

tlively avatar Nov 08 '25 04:11 tlively