bytecodealliance / bytecodealliance/wasmtime

Regionless-loads can return stale results

Open
#14,323 0 comments 0 reactions 0 assignees View on GitHub
cranelift
Dominant language
Rust
Stars
18.6k
Forks
1.8k
Avg merge
1d 18h
Merged PRs (30d)
126

Description

This test:

```
test interpret
test run
set opt_level=speed
target x86_64
target aarch64

;; A load with no alias region may alias any region, so it must observe a
;; preceding store that carries an alias region. Alias analysis instead keys
;; the regionless load on `last_fence` only and forwards the value of the
;; earlier region0 load (v1 = 1), dropping the intervening store of 42.
function %regionless_load_after_region_store(i64) -> i32 {
ss0 = explicit_slot 4
region0 = 0 "heap"
block0(v0: i64):
v9 = stack_addr.i64 ss0
v8 = iconst.i32 1
store notrap v8, v9
v1 = load.i32 notrap region0 v9
v2 = iconst.i32 42
store notrap region0 v2, v9
v3 = load.i32 notrap v9
v4 = iadd v3, v1
return v4
}
; run: %regionless_load_after_region_store(0) == 43
```

fails with:

```
$ cargo run -p cranelift-tools test ./regionless-load.clif
Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.07s
Running `/home/alex/code/wasmtime2/target/debug/clif-util test ./regionless-load.clif`
[2026-09-11T21:06:41Z ERROR cranelift_filetests::concurrent] FAIL: run
FAIL ./regionless-load.clif: run

Caused by:
Failed test: run: %regionless_load_after_region_store(0) == 43, actual: 2
1 tests
Error: 1 failure
```

and a similar test case:

```
test interpret
test run
set opt_level=speed
target x86_64

function %dse(i64) -> i32 {
ss0 = explicit_slot 4
region0 = 0 "heap"
block0(v0: i64):
v9 = stack_addr.i64 ss0
v2 = iconst.i32 42
store notrap region0 v2, v9
v3 = load.i32 notrap v9
v5 = iconst.i32 7
store notrap region0 v5, v9
return v3
}
; run: %dse(0) == 42
```

fails with:

```
$ cargo run -p cranelift-tools test ./regionless-load-dse.clif
Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.12s
Running `/home/alex/code/wasmtime2/target/debug/clif-util test ./regionless-load-dse.clif`
[2026-09-11T21:07:29Z ERROR cranelift_filetests::concurrent] FAIL: run
FAIL ./regionless-load-dse.clif: run

Caused by:
Failed test: run: %dse(0) == 42, actual: -2147474110
1 tests
Error: 1 failure
```

a full llm-generated report is [here](https://gist.github.com/alexcrichton/792b27a568277a5a4ded4e835fecc283) if that's useful. I'm relatively certain that this is not UB and the tests here are correct, but I'm not 100% certain. If this is IR-level UB then this can just be closed.

cc @fitzgen

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.