CABI: trap on misaligned waitable-set.{wait,poll} ptr (#741)

unpack_event stored the two i32 event payloads at the guest-supplied `ptr`
through store, whose alignment and bounds checks are assertions rather than
traps. A misaligned or out-of-bounds `ptr` thus raised an AssertionError in
the reference interpreter instead of trapping, and the prose said nothing.

Trap unless `ptr` is 4-byte-aligned and `ptr + 8` is within memory, matching
the checks lower_flat_values applies to an out-param pointer and what
Wasmtime already does. Document this in CanonicalABI.md and the Explainer,
whose description of waitable-set.wait wrongly called `payload-addr`
8-byte-aligned: the payload is two contiguous i32s, so 4-byte alignment is
all the ABI requires.

Assisted-by: claude:claude-fable-5-1

Signed-off-by: Roman Volosatovs <rvolosatovs@riseup.net>

Author: rvolosatovs

design/mvp/CanonicalABI.md

@@ -4043,10 +4043,15 @@ def canon_waitable_set_wait(mem, si, ptr):
 def unpack_event(mem, inst, ptr, e: EventTuple):
   event, p1, p2 = e
   cx = LiftLowerContext(LiftLowerOptions(memory = mem), inst)
+  trap_if(ptr != align_to(ptr, 4))
+  trap_if(ptr + 8 > len(cx.opts.memory))
   store(cx, p1, U32Type(), ptr)
   store(cx, p2, U32Type(), ptr + 4)
   return [event]
 ```
+Note that `ptr` points to an 8-byte region of memory into which the two
+`i32` payloads of the event are stored. `ptr` must be 4-byte-aligned and the
+whole region must be in bounds, trapping otherwise.
 
 
 ### 🔀 `canon waitable-set.poll`

design/mvp/Explainer.md

@@ -1841,7 +1841,8 @@ Lastly, the `task-cancelled` event is never returned by `waitable-set.wait` or
 
 In the Canonical ABI, the `event-code` return value provides the `event`
 discriminant and the case payloads are stored as two contiguous `i32`s at the
-8-byte-aligned address `payload-addr`.
+4-byte-aligned address `payload-addr`, trapping if `payload-addr` is misaligned
+or out of bounds.
 
 For details, see [Waitables and Waitable Sets] in the concurrency explainer and
 [`canon_waitable_set_wait`] in the Canonical ABI explainer.

design/mvp/canonical-abi/definitions.py

@@ -2329,6 +2329,8 @@ def canon_waitable_set_wait(mem, si, ptr):
 def unpack_event(mem, inst, ptr, e: EventTuple):
   event, p1, p2 = e
   cx = LiftLowerContext(LiftLowerOptions(memory = mem), inst)
+  trap_if(ptr != align_to(ptr, 4))
+  trap_if(ptr + 8 > len(cx.opts.memory))
   store(cx, p1, U32Type(), ptr)
   store(cx, p2, U32Type(), ptr + 4)
   return [event]