AIKIDO-2026-350616

TL;DR

Wasmtime's bulk WebAssembly operations such as memory.copy, table.grow, and array.copy inject fuel and epoch preemption checks in the middle of the transfer. When an embedder mutates the Store from an epoch callback, or cancels a computation and later resumes wasm in the same store, those mid-operation checkpoints can expose inconsistent internal state: a non-nullable table left grown but still null-filled, stale linear-memory pointers used after a grow moves the buffer, or GC heap corruption after a GC during an array.copy. The fix restores earlier behavior by checking fuel once before the bulk operation and not preempting during it.