Fix `select` missing stack map declarations for GC refs by fitzgen · Pull Request #12862 · bytecodealliance/wasmtime

@fitzgen

The `select` and typed `select` Wasm operators create new SSA values in
Cranelift but were not calling `declare_value_needs_stack_map` on the result
when the operand type is a GC reference. This meant the result, when kept on the
Wasm operand stack (not stored in a local variable), would not appear in stack
maps at subsequent safepoints.

If a GC collection occurred at such a safepoint, the collector would not see the
`select`'s result as a live GC root and could free the referenced object,
leading to use-after-free.

The fix checks `select`'s operand types for reference types and declares the
result as requiring inclusion in stack maps when needed.

@fitzgen

@fitzgen

Merged via the queue into bytecodealliance:main with commit 2cd4882

Mar 30, 2026

47 checks passed

@fitzgen fitzgen deleted the select-declare-needs-stack-map branch

March 30, 2026 15:04