A Comprehensive Study of Bugs in Embedded WebAssembly Virtual Machines

WebAssembly is an emerging secure instruction set architecture widely used in embedded applications. Despite its success, bugs in WebAssembly virtual machines can compromise safety. This paper presents the first empirical study of bugs in embedded WebAssembly virtual machines, examining four popular ones: Wasmer, Wasmtime, WAMR, and Wasm3. We qualitatively identify unique bugs, analyze their roots, fixes, and reproductions, and conduct a quantitative study on bug lifecycles, testing, and fixing. Key findings include a proposed bug taxonomy and significant variations in bug fixing times (16.72 to 98.24 days). We recommend a dual-focus approach for developers, addressing common issues and feature-specific challenges. Our insights aim to guide WebAssembly development, testing, and tool-building for improved system quality.