WebAssembly / WebAssembly/binaryen
Fuzz bug with return_call_ref of imported function reference
Open
@stevenfontanella is already working on this.
Since Jan 15, 2026.
- Dominant language
- WebAssembly
- Stars
- 8.6k
- Forks
- 885
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 69
Description
;; primary.wast
(module
(global $foo (export "foo") (mut funcref) (ref.func $foo))
(func $foo)
)
;; secondary.wast
(module
(type $f (func))
(import "primary" "foo" (global $gimport$0 (mut funcref)))
(func $bar (export "bar") (type $f)
(return_call_ref $f
(ref.cast (ref null $f)
(global.get $gimport$0)
)
)
)
)
$ wasm-opt -all primary.wast --fuzz-exec-before --fuzz-exec-second=secondary.wast
[fuzz-exec] running second module
[fuzz-exec] calling bar
Fatal: Module::getFunction: foo does not exist
Looks like the return call interpreter machinery does not look up function references in the correct instance.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.