fix: harden Wasmtime integration

.git-third-party/config.json

@@ -2,13 +2,13 @@
 	"repos": {
 		"executor/third-party/wasmtime": {
 			"url": "https://github.com/bytecodealliance/wasmtime.git",
-			"commit": "6844a83b530f86ad13a65175282fe2dbcd33cad1",
-			"patches": 5,
+			"commit": "f8557c1ad85b8fc123b715d15db7b52483eade96",
+			"patches": 6,
 			"submodules": []
 		},
 		"executor/third-party/wasm-tools": {
 			"url": "https://github.com/bytecodealliance/wasm-tools.git",
-			"commit": "76927bf4bdbddf4b15f835c5eddfffbdfe3bdbd5",
+			"commit": "42127681cc850a4dc62824efc3786e25aa5f9910",
 			"patches": 1
 		}
 	}

.git-third-party/patches/executor/third-party/wasm-tools/1

@@ -9,7 +9,7 @@ Subject: [PATCH] fix: expose method for fuzzing
  2 files changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/crates/wasm-smith/src/core.rs b/crates/wasm-smith/src/core.rs
-index e37ab57..502262b 100644
+index e37ab57ed..502262b28 100644
 --- a/crates/wasm-smith/src/core.rs
 +++ b/crates/wasm-smith/src/core.rs
 @@ -2573,7 +2573,7 @@ impl Module {
@@ -22,7 +22,7 @@ index e37ab57..502262b 100644
 
                  // If a function list is possible then build up a list of
 diff --git a/crates/wasm-smith/src/core/encode.rs b/crates/wasm-smith/src/core/encode.rs
-index d2ffd48..5b9b551 100644
+index d2ffd4887..5b9b5514a 100644
 --- a/crates/wasm-smith/src/core/encode.rs
 +++ b/crates/wasm-smith/src/core/encode.rs
 @@ -6,7 +6,8 @@ impl Module {

.git-third-party/patches/executor/third-party/wasmtime/2

@@ -19,10 +19,10 @@ Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
  2 files changed, 50 insertions(+), 47 deletions(-)
 
 diff --git a/crates/wasmtime/src/runtime/func.rs b/crates/wasmtime/src/runtime/func.rs
-index c19cf62f..c09f17b5 100644
+index 7315339ef..358ae2f61 100644
 --- a/crates/wasmtime/src/runtime/func.rs
 +++ b/crates/wasmtime/src/runtime/func.rs
-@@ -1418,6 +1418,53 @@ impl std::fmt::Display for Fingerprint {
+@@ -1419,6 +1419,53 @@ impl std::fmt::Display for Fingerprint {
      }
  }
 
@@ -76,7 +76,7 @@ index c19cf62f..c09f17b5 100644
  /// Prepares for entrance into WebAssembly.
  ///
  /// This function will set up context such that `closure` is allowed to call a
-@@ -1451,52 +1498,10 @@ pub(crate) fn invoke_wasm_and_catch_traps<T>(
+@@ -1452,52 +1499,10 @@ pub(crate) fn invoke_wasm_and_catch_traps<T>(
      }
      core::mem::drop(previous_runtime_state);
      store.0.call_hook(CallHook::ReturningFromWasm)?;
@@ -133,10 +133,10 @@ index c19cf62f..c09f17b5 100644
 
  /// This type helps managing the state of the runtime when entering and exiting
 diff --git a/crates/wasmtime/src/runtime/store.rs b/crates/wasmtime/src/runtime/store.rs
-index 16e617d2..3656a449 100644
+index 78a8e4567..789a8bb71 100644
 --- a/crates/wasmtime/src/runtime/store.rs
 +++ b/crates/wasmtime/src/runtime/store.rs
-@@ -725,8 +725,6 @@ enum StoreInstanceKind {
+@@ -723,8 +723,6 @@ enum StoreInstanceKind {
  pub struct GenVMCtx {
      /// non-zero if should quit
      pub should_quit: Arc<std::sync::atomic::AtomicU32>,

.git-third-party/patches/executor/third-party/wasmtime/3

@@ -18,10 +18,10 @@ Claude-Session: https://claude.ai/code/session_013QtkVNJFxWsNwCLhTp5idV
  1 file changed, 4 insertions(+), 3 deletions(-)
 
 diff --git a/crates/cranelift/src/translate/code_translator.rs b/crates/cranelift/src/translate/code_translator.rs
-index 9dde783c..927df0f8 100644
+index ad613df54..7517b54d1 100644
 --- a/crates/cranelift/src/translate/code_translator.rs
 +++ b/crates/cranelift/src/translate/code_translator.rs
-@@ -1750,7 +1750,8 @@ pub fn translate_operator(
+@@ -1751,7 +1751,8 @@ pub fn translate_operator(
          }
          Operator::F32x4Splat
          | Operator::F64x2Splat => {
@@ -31,7 +31,7 @@ index 9dde783c..927df0f8 100644
              let splatted = builder.ins().splat(type_of(op), environ.stacks.pop1());
              environ.stacks.push1(splatted)
          }
-@@ -1839,7 +1840,7 @@ pub fn translate_operator(
+@@ -1840,7 +1841,7 @@ pub fn translate_operator(
          }
          Operator::F32x4ExtractLane { lane }
          | Operator::F64x2ExtractLane { lane } => {
@@ -40,7 +40,7 @@ index 9dde783c..927df0f8 100644
              let vector = pop1_with_bitcast(environ, type_of(op), builder);
              environ
                  .stacks
-@@ -1864,7 +1865,7 @@ pub fn translate_operator(
+@@ -1865,7 +1866,7 @@ pub fn translate_operator(
          }
          Operator::F32x4ReplaceLane { lane }
          | Operator::F64x2ReplaceLane { lane } => {

.git-third-party/patches/executor/third-party/wasmtime/4

@@ -11,14 +11,14 @@ Content-Transfer-Encoding: 8bit
  crates/cranelift/src/func_environ.rs              | 4 ++--
  crates/cranelift/src/lib.rs                       | 4 ++--
  crates/cranelift/src/translate/code_translator.rs | 2 +-
- crates/environ/src/trap_encoding.rs               | 8 ++++----
- 4 files changed, 9 insertions(+), 9 deletions(-)
+ crates/environ/src/trap_encoding.rs               | 4 ++--
+ 4 files changed, 7 insertions(+), 7 deletions(-)
 
 diff --git a/crates/cranelift/src/func_environ.rs b/crates/cranelift/src/func_environ.rs
-index 8f549ff5..0c5821fa 100644
+index ec49b7acf..c2ed7b2ba 100644
 --- a/crates/cranelift/src/func_environ.rs
 +++ b/crates/cranelift/src/func_environ.rs
-@@ -3929,9 +3929,9 @@ impl FuncEnvironment<'_> {
+@@ -3952,9 +3952,9 @@ impl FuncEnvironment<'_> {
          self.fuel_save_from_var(builder);
      }
 
@@ -31,10 +31,10 @@ index 8f549ff5..0c5821fa 100644
      }
 
 diff --git a/crates/cranelift/src/lib.rs b/crates/cranelift/src/lib.rs
-index 4db70f6a..8119e7da 100644
+index 66c56b849..6a3a89af7 100644
 --- a/crates/cranelift/src/lib.rs
 +++ b/crates/cranelift/src/lib.rs
-@@ -72,8 +72,8 @@ pub const TRAP_CONTINUATION_ALREADY_CONSUMED: TrapCode =
+@@ -73,8 +73,8 @@ pub const TRAP_CONTINUATION_ALREADY_CONSUMED: TrapCode =
      TrapCode::unwrap_user(Trap::ContinuationAlreadyConsumed as u8 + TRAP_OFFSET);
  pub const TRAP_CAST_FAILURE: TrapCode =
      TrapCode::unwrap_user(Trap::CastFailure as u8 + TRAP_OFFSET);
@@ -46,10 +46,10 @@ index 4db70f6a..8119e7da 100644
  /// Creates a new cranelift `Signature` with no wasm params/results for the
  /// given calling convention.
 diff --git a/crates/cranelift/src/translate/code_translator.rs b/crates/cranelift/src/translate/code_translator.rs
-index 927df0f8..b5cf3d17 100644
+index 7517b54d1..a5f477580 100644
 --- a/crates/cranelift/src/translate/code_translator.rs
 +++ b/crates/cranelift/src/translate/code_translator.rs
-@@ -4574,6 +4574,6 @@ fn float_op_unreachable_check(environ: &mut FuncEnvironment<'_>, builder: &mut F
+@@ -4575,6 +4575,6 @@ fn float_op_unreachable_check(environ: &mut FuncEnvironment<'_>, builder: &mut F
      if environ.are_floats_enabled() {
          return false;
      }
@@ -58,35 +58,17 @@ index 927df0f8..b5cf3d17 100644
      return true;
  }
 diff --git a/crates/environ/src/trap_encoding.rs b/crates/environ/src/trap_encoding.rs
-index 2d49707b..fe4f0dea 100644
+index f2c969e1e..1c18d90ea 100644
 --- a/crates/environ/src/trap_encoding.rs
 +++ b/crates/environ/src/trap_encoding.rs
-@@ -142,8 +142,8 @@ pub enum Trap {
-     /// value.
-     UnalignedPointer,
+@@ -216,8 +216,8 @@ generate_trap_type! {
+         /// Cannot resume a thread which is not suspended.
+         CannotResumeThread = "cannot resume thread which is not suspended",
 
--    /// Deterministic mode violation
--    DeterministicMode,
-+    /// Nondeterministic instruction executed in deterministic mode
-+    NondetInstruction,
-     // if adding a variant here be sure to update the `check!` macro below, and
-     // remember to update `trap.rs` and `trap.h` as mentioned above
- }
-@@ -196,7 +196,7 @@ impl Trap {
-             ListOutOfBounds
-             InvalidDiscriminant
-             UnalignedPointer
--            DeterministicMode
-+            NondetInstruction
-         }
+-        /// Deterministic mode violation.
+-        DeterministicMode = "deterministic mode violation (cpu)",
++        /// Nondeterministic instruction executed in deterministic mode.
++        NondetInstruction = "nondeterministic instruction (cpu)",
 
-         None
-@@ -242,7 +242,7 @@ impl fmt::Display for Trap {
-             ListOutOfBounds => "list content out-of-bounds",
-             InvalidDiscriminant => "invalid variant discriminant",
-             UnalignedPointer => "unaligned pointer",
--            DeterministicMode => "deterministic mode violation (cpu)",
-+            NondetInstruction => "nondeterministic instruction (cpu)",
-         };
-         write!(f, "wasm trap: {desc}")
-     }
+         // if adding a variant here be sure to update `trap.rs` and `trap.h` as
+         // mentioned above

.git-third-party/patches/executor/third-party/wasmtime/5

@@ -10,10 +10,10 @@ Subject: [PATCH] feat(genvm): configure wasm stack limits
  3 files changed, 26 insertions(+), 1 deletion(-)
 
 diff --git a/crates/wasmtime/src/config.rs b/crates/wasmtime/src/config.rs
-index 1cbbd4b2..746ae852 100644
+index 0b00c8395..06bbd731a 100644
 --- a/crates/wasmtime/src/config.rs
 +++ b/crates/wasmtime/src/config.rs
-@@ -160,6 +160,8 @@ pub struct Config {
+@@ -163,6 +163,8 @@ pub struct Config {
      pub(crate) custom_code_memory: Option<Arc<dyn CustomCodeMemory>>,
      pub(crate) allocation_strategy: InstanceAllocationStrategy,
      pub(crate) max_wasm_stack: usize,
@@ -22,16 +22,16 @@ index 1cbbd4b2..746ae852 100644
      /// Explicitly enabled features via `Config::wasm_*` methods. This is a
      /// signal that the embedder specifically wants something turned on
      /// regardless of the defaults that Wasmtime might otherwise have enabled.
-@@ -274,6 +276,8 @@ impl Config {
+@@ -277,6 +279,8 @@ impl Config {
              // 1` forces this), or at least it passed when this change was
              // committed.
              max_wasm_stack: 512 * 1024,
 +            wasm_call_stack_limit: 1024,
 +            wasm_value_stack_limit: 65535,
-             wasm_backtrace: true,
              wasm_backtrace_details_env_used: false,
+             wasm_backtrace_max_frames: Some(DEFAULT_WASM_BACKTRACE_MAX_FRAMES),
              native_unwind_info: None,
-@@ -741,6 +745,16 @@ impl Config {
+@@ -779,6 +783,16 @@ impl Config {
          self
      }
 
@@ -49,10 +49,10 @@ index 1cbbd4b2..746ae852 100644
      ///
      /// This setting configures the size of the stacks that are allocated for
 diff --git a/crates/wasmtime/src/runtime/store.rs b/crates/wasmtime/src/runtime/store.rs
-index 3656a449..ce31edb4 100644
+index 789a8bb71..e80dd5142 100644
 --- a/crates/wasmtime/src/runtime/store.rs
 +++ b/crates/wasmtime/src/runtime/store.rs
-@@ -753,7 +753,10 @@ impl<T> Store<T> {
+@@ -751,7 +751,10 @@ impl<T> Store<T> {
          let inner = StoreOpaque {
              _marker: marker::PhantomPinned,
              engine: engine.clone(),
@@ -65,10 +65,10 @@ index 3656a449..ce31edb4 100644
              continuations: Vec::new(),
              instances: wasmtime_environ::collections::PrimaryMap::new(),
 diff --git a/crates/wasmtime/src/runtime/vm/vmcontext.rs b/crates/wasmtime/src/runtime/vm/vmcontext.rs
-index 01e3373a..cc0421c3 100644
+index a80eed44a..b6a441901 100644
 --- a/crates/wasmtime/src/runtime/vm/vmcontext.rs
 +++ b/crates/wasmtime/src/runtime/vm/vmcontext.rs
-@@ -1196,6 +1196,14 @@ pub struct VMStoreContext {
+@@ -1229,6 +1229,14 @@ pub struct VMStoreContext {
  }
 
  impl VMStoreContext {