chore: port pending executor and release hardening

[kp2pml30]

Auto-opened executor mirror of genlayerlabs/genvm-manager#36.

Carries the executor-side work for that manager PR. The manager branch update fast-forwards v0.2-dev to its pinned commit after landing.

Summary by CodeRabbit

• New Features

  • Added configurable WebAssembly call-stack and value-stack limits, with clear overflow traps.
  • Added optional floating-point instruction support and nondeterministic-instruction traps for deterministic execution.
  • Added APIs to generate fingerprints of WebAssembly linear memories.
  • Added improved memory bounds validation and reporting for host integrations.

• Bug Fixes

  • Corrected deterministic handling of selected SIMD lane operations.
  • Improved backtrace configuration for deterministic and nondeterministic execution modes.
  • Enhanced diagnostic messages for invalid reference types.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 902c5fd9-3d2f-4f3b-875c-c0af99e4a3c0

📥 Commits

Reviewing files that changed from the base of the PR and between bac7bb2 and a27db42.

⛔ Files ignored due to path filters (14)

• .git-third-party/manifest.json is excluded by !**/*.json
• executor/Cargo.lock is excluded by !**/*.lock, !**/*.lock
• tests/integration/stable/exploits/flt.0.hash is excluded by !**/*.hash, !**/tests/**
• tests/integration/stable/exploits/flt.0.stdout is excluded by !**/*.stdout, !**/tests/**
• tests/integration/stable/exploits/rec.0.hash is excluded by !**/*.hash, !**/tests/**
• tests/integration/stable/exploits/rec_1024.0.hash is excluded by !**/*.hash, !**/tests/**
• tests/integration/stable/exploits/simd_float_arithmetic.0.hash is excluded by !**/*.hash, !**/tests/**
• tests/integration/stable/exploits/simd_float_arithmetic.0.stdout is excluded by !**/*.stdout, !**/tests/**
• tests/integration/stable/exploits/simd_float_arithmetic.jsonnet is excluded by !**/tests/**
• tests/integration/stable/exploits/simd_float_arithmetic.wat is excluded by !**/tests/**
• tests/integration/stable/exploits/simd_float_lane_copy.0.hash is excluded by !**/*.hash, !**/tests/**
• tests/integration/stable/exploits/simd_float_lane_copy.0.stdout is excluded by !**/*.stdout, !**/tests/**
• tests/integration/stable/exploits/simd_float_lane_copy.jsonnet is excluded by !**/tests/**
• tests/integration/stable/exploits/simd_float_lane_copy.wat is excluded by !**/tests/**

📒 Files selected for processing (7)

• .git-third-party/patches/executor/third-party/wasm-tools/n359mz2sdabr2wsa
• .git-third-party/patches/executor/third-party/wasmtime/4rr93pqjtwm5m701
• .git-third-party/patches/executor/third-party/wasmtime/6xy06vg0d71czwmm
• .git-third-party/patches/executor/third-party/wasmtime/gbm0xv16dc1fs2km
• .git-third-party/patches/executor/third-party/wasmtime/r6518c8dxghpkhsj
• .git-third-party/patches/executor/third-party/wasmtime/zsjxmza3dms0hr10
• executor/src/rt/supervisor/mod.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The changes extend Wasmtime with semantic stack limits, configurable floating-point execution, renamed nondeterministic-instruction traps, memory fingerprint APIs, local wasm-tools dependencies, updated wiggle bindings, and deterministic backtrace limits. They also expose wasm-smith::Module::encoded.

Changes

Wasmtime runtime and tooling

Layer / File(s)	Summary
Semantic stack limits .git-third-party/patches/executor/third-party/wasmtime/6xy06vg0d71czwmm, .git-third-party/patches/executor/third-party/wasmtime/gbm0xv16dc1fs2km	Wasmtime tracks call-depth and value-slot limits in VMStoreContext. Translation decrements limits at function entry and restores them on return or caught exceptions.
Floating-point and trap behavior .git-third-party/patches/executor/third-party/wasmtime/4rr93pqjtwm5m701, .git-third-party/patches/executor/third-party/wasmtime/gbm0xv16dc1fs2km, .git-third-party/patches/executor/third-party/wasmtime/r6518c8dxghpkhsj	Floating-point operations respect the floats_enabled setting. Selected SIMD lane operations no longer reject deterministic execution. Trap names change from deterministic-mode terminology to nondeterministic-instruction terminology.
Wasm-tools and binding integration .git-third-party/patches/executor/third-party/wasm-tools/n359mz2sdabr2wsa, .git-third-party/patches/executor/third-party/wasmtime/gbm0xv16dc1fs2km	Wasmtime uses local wasm-tools path dependencies. Cache validation, wiggle context generation, memory bounds checks, and missing-memory errors are updated. Module::encoded becomes public.
Memory fingerprint APIs .git-third-party/patches/executor/third-party/wasmtime/gbm0xv16dc1fs2km, .git-third-party/patches/executor/third-party/wasmtime/zsjxmza3dms0hr10	Stores expose memory fingerprint methods that hash unshared memories and disambiguate duplicate module names. Trap-time fingerprint capture is removed.
Supervisor backtrace configuration executor/src/rt/supervisor/mod.rs	Deterministic engines use a 20-frame backtrace limit. Non-deterministic engines disable backtrace frames.

Priority: ➖ Normal

Estimated code review effort: 5 (Critical) | ~90 minutes

Change: Other

Sequence Diagram(s)

sequenceDiagram
  participant WasmFunction
  participant FuncEnvironment
  participant VMStoreContext
  WasmFunction->>FuncEnvironment: enter function
  FuncEnvironment->>VMStoreContext: load stack limits
  FuncEnvironment->>VMStoreContext: store decremented limits
  WasmFunction->>FuncEnvironment: return or catch exception
  FuncEnvironment->>VMStoreContext: restore limits

Loading

Merge Risk: ⚪ Minimal · up to a27db

The runtime integration changes have no identified actionable regression, so the change is ready to merge after normal checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (6 skipped: 6 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: porting pending executor changes and release hardening. It is concise and specific enough for the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (6 skipped: 6 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pr/v0.2/chore/port-pending-fixes

Warning

Some tools did not complete. Review the errors below.

🔧 Clippy (1.98.0)

Clippy execution failed

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}