Skip to content

[spec] Fix limit validation for memory and table types #2059

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rossberg merged 1 commit into from
Jan 27, 2026
Merged

[spec] Fix limit validation for memory and table types #2059

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions specification/wasm-3.0/2.1-validation.types.spectec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,11 +222,11 @@ rule Globaltype_ok:

rule Memtype_ok:
C |- addrtype limits PAGE : OK
-- Limits_ok: C |- limits : $(2^16)
-- Limits_ok: C |- limits : $(2^($size(addrtype) - 16))

rule Tabletype_ok:
C |- addrtype limits reftype : OK
-- Limits_ok: C |- limits : $(2^32 - 1)
-- Limits_ok: C |- limits : $(2^$size(addrtype) - 1)
-- Reftype_ok: C |- reftype : OK


Expand Down
Binary file modified spectec/doc/example/output/NanoWasm.pdf
View file
Open in desktop
Binary file not shown.
4 changes: 2 additions & 2 deletions spectec/test-frontend/TEST.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3148,14 +3148,14 @@ relation Memtype_ok: `%|-%:OK`(context, memtype)
;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
rule _{C : context, addrtype : addrtype, limits : limits}:
`%|-%:OK`(C, `%%PAGE`_memtype(addrtype, limits))
-- Limits_ok: `%|-%:%`(C, limits, (2 ^ 16))
-- Limits_ok: `%|-%:%`(C, limits, (2 ^ ((($size((addrtype : addrtype <: numtype)) : nat <:> int) - (16 : nat <:> int)) : int <:> nat)))

;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
relation Tabletype_ok: `%|-%:OK`(context, tabletype)
;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
rule _{C : context, addrtype : addrtype, limits : limits, reftype : reftype}:
`%|-%:OK`(C, `%%%`_tabletype(addrtype, limits, reftype))
-- Limits_ok: `%|-%:%`(C, limits, ((((2 ^ 32) : nat <:> int) - (1 : nat <:> int)) : int <:> nat))
-- Limits_ok: `%|-%:%`(C, limits, ((((2 ^ $size((addrtype : addrtype <: numtype))) : nat <:> int) - (1 : nat <:> int)) : int <:> nat))
-- Reftype_ok: `%|-%:OK`(C, reftype)

;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
Expand Down
4 changes: 2 additions & 2 deletions spectec/test-latex/TEST.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5072,7 +5072,7 @@ $$
$$
\begin{array}{@{}c@{}}\displaystyle
\frac{
C \vdash {\mathit{limits}} : {2^{16}}
C \vdash {\mathit{limits}} : {2^{{|{\mathit{addrtype}}|} - 16}}
}{
C \vdash {\mathit{addrtype}}~{\mathit{limits}}~\mathsf{page} : \mathsf{ok}
} \, {[\textsc{\scriptsize K{-}mem}]}
Expand All @@ -5083,7 +5083,7 @@ $$
$$
\begin{array}{@{}c@{}}\displaystyle
\frac{
C \vdash {\mathit{limits}} : {2^{32}} - 1
C \vdash {\mathit{limits}} : {2^{{|{\mathit{addrtype}}|}}} - 1
\qquad
C \vdash {\mathit{reftype}} : \mathsf{ok}
}{
Expand Down
12 changes: 6 additions & 6 deletions spectec/test-middlend/TEST.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3138,14 +3138,14 @@ relation Memtype_ok: `%|-%:OK`(context, memtype)
;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
rule _{C : context, addrtype : addrtype, limits : limits}:
`%|-%:OK`(C, `%%PAGE`_memtype(addrtype, limits))
-- Limits_ok: `%|-%:%`(C, limits, (2 ^ 16))
-- Limits_ok: `%|-%:%`(C, limits, (2 ^ ((($size((addrtype : addrtype <: numtype)) : nat <:> int) - (16 : nat <:> int)) : int <:> nat)))

;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
relation Tabletype_ok: `%|-%:OK`(context, tabletype)
;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
rule _{C : context, addrtype : addrtype, limits : limits, reftype : reftype}:
`%|-%:OK`(C, `%%%`_tabletype(addrtype, limits, reftype))
-- Limits_ok: `%|-%:%`(C, limits, ((((2 ^ 32) : nat <:> int) - (1 : nat <:> int)) : int <:> nat))
-- Limits_ok: `%|-%:%`(C, limits, ((((2 ^ $size((addrtype : addrtype <: numtype))) : nat <:> int) - (1 : nat <:> int)) : int <:> nat))
-- Reftype_ok: `%|-%:OK`(C, reftype)

;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
Expand Down Expand Up @@ -14492,14 +14492,14 @@ relation Memtype_ok: `%|-%:OK`(context, memtype)
;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
rule _{C : context, addrtype : addrtype, limits : limits}:
`%|-%:OK`(C, `%%PAGE`_memtype(addrtype, limits))
-- Limits_ok: `%|-%:%`(C, limits, (2 ^ 16))
-- Limits_ok: `%|-%:%`(C, limits, (2 ^ ((($size((addrtype : addrtype <: numtype)) : nat <:> int) - (16 : nat <:> int)) : int <:> nat)))

;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
relation Tabletype_ok: `%|-%:OK`(context, tabletype)
;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
rule _{C : context, addrtype : addrtype, limits : limits, reftype : reftype}:
`%|-%:OK`(C, `%%%`_tabletype(addrtype, limits, reftype))
-- Limits_ok: `%|-%:%`(C, limits, ((((2 ^ 32) : nat <:> int) - (1 : nat <:> int)) : int <:> nat))
-- Limits_ok: `%|-%:%`(C, limits, ((((2 ^ $size((addrtype : addrtype <: numtype))) : nat <:> int) - (1 : nat <:> int)) : int <:> nat))
-- Reftype_ok: `%|-%:OK`(C, reftype)

;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
Expand Down Expand Up @@ -25865,14 +25865,14 @@ relation Memtype_ok: `%|-%:OK`(context, memtype)
;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
rule _{C : context, addrtype : addrtype, limits : limits}:
`%|-%:OK`(C, `%%PAGE`_memtype(addrtype, limits))
-- Limits_ok: `%|-%:%`(C, limits, (2 ^ 16))
-- Limits_ok: `%|-%:%`(C, limits, (2 ^ ((($size((addrtype : addrtype <: numtype)) : nat <:> int) - (16 : nat <:> int)) : int <:> nat)))

;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
relation Tabletype_ok: `%|-%:OK`(context, tabletype)
;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
rule _{C : context, addrtype : addrtype, limits : limits, reftype : reftype}:
`%|-%:OK`(C, `%%%`_tabletype(addrtype, limits, reftype))
-- Limits_ok: `%|-%:%`(C, limits, ((((2 ^ 32) : nat <:> int) - (1 : nat <:> int)) : int <:> nat))
-- Limits_ok: `%|-%:%`(C, limits, ((((2 ^ $size((addrtype : addrtype <: numtype))) : nat <:> int) - (1 : nat <:> int)) : int <:> nat))
-- Reftype_ok: `%|-%:OK`(C, reftype)

;; ../../../../specification/wasm-3.0/2.1-validation.types.spectec
Expand Down
8 changes: 4 additions & 4 deletions spectec/test-prose/TEST.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14776,15 +14776,15 @@ The global type :math:`({\mathsf{mut}^?}~t)` is :ref:`valid <valid-val>` if:
The memory type :math:`({\mathit{addrtype}}~{\mathit{limits}}~\mathsf{page})` is :ref:`valid <valid-val>` if:


* The limits range :math:`{\mathit{limits}}` is :ref:`valid <valid-val>` within :math:`{2^{16}}`.
* The limits range :math:`{\mathit{limits}}` is :ref:`valid <valid-val>` within :math:`{2^{{|{\mathit{addrtype}}|} - 16}}`.




The table type :math:`({\mathit{addrtype}}~{\mathit{limits}}~{\mathit{reftype}})` is :ref:`valid <valid-val>` if:


* The limits range :math:`{\mathit{limits}}` is :ref:`valid <valid-val>` within :math:`{2^{32}} - 1`.
* The limits range :math:`{\mathit{limits}}` is :ref:`valid <valid-val>` within :math:`{2^{{|{\mathit{addrtype}}|}}} - 1`.

* The reference type :math:`{\mathit{reftype}}` is :ref:`valid <valid-val>`.

Expand Down Expand Up @@ -27294,11 +27294,11 @@ Globaltype_ok

Memtype_ok
- the memory type addrtype limits PAGE is valid if:
- the limits range limits is valid within (2 ^ 16).
- the limits range limits is valid within (2 ^ ($size(addrtype) - 16)).

Tabletype_ok
- the table type (addrtype limits reftype) is valid if:
- the limits range limits is valid within ((2 ^ 32) - 1).
- the limits range limits is valid within ((2 ^ $size(addrtype)) - 1).
- the reference type reftype is valid.

Externtype_ok
Expand Down