Severity: medium — silent wrong wiring for a legal component shape.
runInitializers' instantiate-module arm zips wasmtime's flat positional
args (trusted info.rs:438-445: one CoreDef per import slot) with
WebAssembly.Module.imports(module) and writes them into a name-keyed
import object (exec/executor.ts:551-566). Core wasm permits two imports
with the same (module, field) pair; when the plan supplies different
CoreDefs for them, the second object write wins and both slots receive
the last value — the length check passes, nothing detects it, the wrong
function gets called.
The JS WebAssembly API genuinely cannot express per-slot values for
duplicate names, so the fix is honesty: while building the import object,
fail loudly (typed error naming module/field) on a duplicate key unless
the resolved values are reference-identical (identical is safe — the JS
API cannot distinguish the slots).
Test: fixture core module with a duplicated (import "a" "b" (func ...))
pair wired to two different lowered imports.
Found in the 2026-08-10 adversarial conformance review (runtime + translator vs component-model @ 73b7ad5 definitions.py; wasmtime-environ 47.0.3 treated as trusted).
Severity: medium — silent wrong wiring for a legal component shape.
runInitializers' instantiate-module arm zips wasmtime's flat positionalargs (trusted info.rs:438-445: one
CoreDefper import slot) withWebAssembly.Module.imports(module)and writes them into a name-keyedimport object (exec/executor.ts:551-566). Core wasm permits two imports
with the same
(module, field)pair; when the plan supplies differentCoreDefs for them, the second object write wins and both slots receivethe last value — the length check passes, nothing detects it, the wrong
function gets called.
The JS
WebAssemblyAPI genuinely cannot express per-slot values forduplicate names, so the fix is honesty: while building the import object,
fail loudly (typed error naming module/field) on a duplicate key unless
the resolved values are reference-identical (identical is safe — the JS
API cannot distinguish the slots).
Test: fixture core module with a duplicated
(import "a" "b" (func ...))pair wired to two different lowered imports.
Found in the 2026-08-10 adversarial conformance review (runtime + translator vs component-model @ 73b7ad5 definitions.py; wasmtime-environ 47.0.3 treated as trusted).