#5303·WasmEdge

bug: memory.atomic.notify incorrectly traps at the final valid 4-byte memory address

Author: mohitagarwal24Created Aug 23, 2026Updated Aug 24, 2026
Labelsbug

Summary

memory.atomic.notify incorrectly performs an 8-byte bounds check even though the instruction has a 4-byte access width. Consequently, the final valid four-byte-aligned address of a memory page traps with MemoryOutOfBounds.

Current State

Executing memory.atomic.notify at address 65532 in a one-page shared memory traps in both interpreter and LLVM JIT modes.

Address 65528 succeeds and returns 0, confirming a false boundary restriction.

Executor::atomicNotify checks the address using:

cpp
MemInst.getPointer<std::atomic<uint64_t> *>(Address)

### Expected State

Address `65532` is four-byte aligned, and bytes `[65532, 65536)` are inside the one-page memory.

With no waiting threads, `memory.atomic.notify` should succeed and return `0`.

### Reproduction steps

1. Build WasmEdge from commit `d516c5d663de9cc275a284ffe4585526d164cca2` with threads and LLVM JIT enabled.

2. Save the following as `notify.wat`:

```wat
(module
  (memory 1 1 shared)
  (func (export "test") (result i32)
    i32.const 65532
    i32.const 0
    memory.atomic.notify))
  1. Compile it:
bash
wat2wasm --enable-threads notify.wat -o notify.wasm
  1. Run it in interpreter mode:
bash
wasmedge run --enable-threads notify.wasm test
  1. Run it in LLVM JIT mode:
bash
wasmedge run --enable-threads --run-mode=jit notify.wasm test
  1. As a control, change the address to 65528. Both modes succeed and return 0.

Any logs you want to share for showing the specific issue

Interpreter: execution failed: out of bounds memory access, Code: 0x408 In instruction: memory.atomic.notify

LLVM JIT: execution failed: out of bounds memory access, Code: 0x408 In instruction: memory.atomic.notify

Components

Core

WasmEdge Version or Commit you used

d516c5d663de9cc275a284ffe4585526d164cca2

Operating system information

Windows 11 (Wsl2)

Hardware Architecture

x86_64

Appendix

Suggested regression coverage:

  • notification at memory_size - 4
  • interpreter execution
  • LLVM JIT execution when LLVM is enabled
  • a nearby successful control case