Severity: low — latent, one feature-flag edit away.
Trusted wasmtime-environ 47.0.3 panics on component start sections and
value imports/exports (translate.rs:1338, :1499 unimplemented!).
Today unreachable: CM_VALUES defaults off and features()
(crates/translator-shim/src/lib.rs:76-87) never enables it, so such
components are rejected in the validation phase, correctly. But nothing
pins this: the feature list has grown twice already, and adding
CM_VALUES would convert these into panics — on the wasm32 C-ABI build an
abort with no error envelope, violating the "never panics on invalid
input" claim (lib.rs:335-336).
Fix (any or all): a comment in features() naming the trap; a test that a
start-section/value component yields a validation-phase envelope; a
catch_unwind at the envelope boundary as a general backstop (wasm32
aborts skip unwinding under panic=abort — if so, the test + comment carry
the weight; note what the build profile actually does).
Found in the 2026-08-10 adversarial conformance review (runtime + translator vs component-model @ 73b7ad5 definitions.py; wasmtime-environ 47.0.3 treated as trusted).
Severity: low — latent, one feature-flag edit away.
Trusted wasmtime-environ 47.0.3 panics on component start sections and
value imports/exports (
translate.rs:1338,:1499unimplemented!).Today unreachable:
CM_VALUESdefaults off andfeatures()(crates/translator-shim/src/lib.rs:76-87) never enables it, so such
components are rejected in the validation phase, correctly. But nothing
pins this: the feature list has grown twice already, and adding
CM_VALUESwould convert these into panics — on the wasm32 C-ABI build anabort with no error envelope, violating the "never panics on invalid
input" claim (lib.rs:335-336).
Fix (any or all): a comment in
features()naming the trap; a test that astart-section/value component yields a validation-phase envelope; a
catch_unwindat the envelope boundary as a general backstop (wasm32aborts skip unwinding under panic=abort — if so, the test + comment carry
the weight; note what the build profile actually does).
Found in the 2026-08-10 adversarial conformance review (runtime + translator vs component-model @ 73b7ad5 definitions.py; wasmtime-environ 47.0.3 treated as trusted).