fix(codegen): call_indirect bounds guard + compile-time type check — OOB/wrong-type traps per WASM §4.4.8 (#642)

[avrabe]

Fixes #642.

The hole

The Thumb-2 (and A32, #596) call_indirect expansion was three unguarded instructions off a runtime index:

lsl.w  ip, idx, #2
ldr.w  ip, [r11, ip]
blx    ip

No cmp/bounds branch, no type comparison — an out-of-bounds or wrong-typed index performed an uncontrolled indirect branch where WASM Core §4.4.8 mandates a deterministic trap. In-bounds dispatch was correct (the #594/#597 arc only ever fixed indexing), which is exactly why index-valid probes never saw it.

Guard design

Bounds check — runtime, both ISAs. The expansion now prepends:

movw ip, #table_size   ; (+ movt when size > 16 bits)
cmp  idx, ip
blo  +1                ; skip the trap when in bounds
udf  #0                ; §4.4.8 OOB trap (same idiom as the div-by-zero guards)

Where does the table size live at runtime? Nowhere — the table is a raw array of 4-byte code pointers linked at r11 by the runtime/harness, with no size field. The size is therefore a compile-time immediate, and it is sound and exact for a defined table: table.grow/table.set are unsupported ops whose functions loud-skip at decode, so nothing synth compiles can resize (or retype) the table. An imported table only yields a bound when its limits pin the size (max == initial); otherwise the lowering declines loudly (a guard against initial on a growable import would trap spec-valid calls).

Type check — discharged at compile time (closed world). The raw code-pointer table stores no type ids, so a runtime tag compare is not implementable with the current layout. Instead DecodedModule::call_indirect_guards() verifies, per expected type t: every slot in [0, table_size) is initialized by a const-offset active element segment with a plain ref.func, and every entry's signature structurally equals types[t] (signature comparison, not index comparison — duplicate types stay interchangeable). Under that property no runtime mismatch is possible; the check compiles away. Any hole — an uninitialized (null-funcref) slot, a heterogeneous entry, a passive/computed segment, a non-zero table index — records a reason and the lowering declines loudly with it. The unchecked branch is never left behind:

• CompileConfig::call_indirect_guards defaults to decline (no module context ⇒ no call_indirect),
• the optimized path now declines call_indirect explicitly (it previously fell through wasm_to_ir's _ => Opcode::Nop),
• both direct selectors (select_with_stack + select_default) gate on the verdicts.

This is the (b) strategy from the issue triage: dissolved images have homogeneous fully-covered tables (the repro verifies), and extending table emission with type ids is moot while synth doesn't emit the table at all.

Red → green evidence

scripts/repro/call_indirect_642_differential.py (new CI job call-indirect-642-oracle): unicorn vs wasmtime on both ISAs, table at r11, and — non-vacuity — the words past the 3-entry table seeded with a valid decoy function (movs r0, #0x5A; bx lr), so an unguarded build doesn't fault, it calls the decoy.

origin/main (a1541c0), both ISAs red:

[Thumb-2] f(5,3)  = 0x5a — the DECOY past the table was CALLED: uncontrolled indirect branch, no bounds guard (#642) MISMATCH
[Thumb-2] f(5,5)  = 0x5a — … MISMATCH
[Thumb-2] f(5,99) = 0x5a — … MISMATCH
[A32]     f(5,3)  = 0x5a — … MISMATCH   (+5, 99)
ORACLE: FAIL — 6 case(s) diverged from wasmtime (#642)

this branch, 12/12 green:

[Thumb-2] f(5,0)=0xf f(5,1)=0xfffffffb f(5,2)=0x32  (= wasmtime)
[Thumb-2] f(5,3)/f(5,5)/f(5,99) = udf trap (wasmtime: trap) OK
[A32]     same 6/6 OK
ORACLE: PASS

Both-ISA status

• Thumb-2 (cortex-m3): guarded, encoding pin updated (test_encode_thumb_call_indirect_lsl2_597 + new _guard_shapes_642 covering the high-reg CMP T2 form and the >16-bit MOVT arm).
• A32 (cortex-r5): guarded, test_encode_arm32_call_indirect_is_real_call_594 updated + new wide-size pin; the call_indirect on the A32 path (--target cortex-r5) compiles to a NOP — silently returns wrong result instead of calling the target #594 A32 differential stays green (now executes the guard in-bounds).
• RISC-V / AArch64: no call_indirect lowering exists (falls to Unsupported → loud-skip) — no shared gap.

Gates

• cargo test --workspace: 2012 passed, 0 failed (was 2004; +5 decoder closed-world tests, +3 selector decline/emit tests, +2 encoder pins, net of split assertions)
• Frozen anchors: frozen_codegen_bytes 10/10 untouched (fixtures carry no call_indirect)
• estimator_encoder_agreement (test(vcr-oracle): estimator↔encoder agreement oracle for the optimized path (#498, #242) #511): green — CallIndirect is a direct-selector-only op, already in the oracle's not-on-optimized-path exclusion list, and the direct path's resolve_label_branches sizes by actual encoding, so the bigger expansion is measured, not estimated
• #594/#597 differentials: green on the fixed build
• cargo fmt --check + cargo clippy --workspace --all-targets -- -D warnings: clean

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 81.65323% with 91 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-core/src/wasm_decoder.rs	79.42%	50 Missing ⚠️
crates/synth-synthesis/src/instruction_selector.rs	72.35%	34 Missing ⚠️
crates/synth-synthesis/src/optimizer_bridge.rs	44.44%	5 Missing ⚠️
crates/synth-backend/src/arm_encoder.rs	98.05%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!