Reusing Legacy Code in WebAssembly: Key Challenges of Cross-Compilation and Code Semantics Preservation

TL;DR

This paper examines the challenges of cross-compiling legacy C/C++ code to WebAssembly, revealing issues in semantic preservation, identifying bugs, and proposing solutions to improve compiler reliability.

Contribution

It introduces WasmChecker, a differential testing framework for WebAssembly, and uncovers 11 new bugs in the Emscripten compiler, advancing understanding of cross-compilation challenges.

Findings

WebAssembly compilers often do not preserve code semantics accurately.

Identified 11 new bugs in the Emscripten compiler toolchain.

Proposed a differential testing approach to evaluate semantic equivalence.

Abstract

WebAssembly (Wasm) has emerged as a powerful technology for executing high-performance code and reusing legacy code in web browsers. With its increasing adoption, ensuring the reliability of WebAssembly code becomes paramount. In this paper, we investigate how well WebAssembly compilers fulfill code reusability. Specifically, we inquire (1) what challenges arise when cross-compiling a high-level language codebase into WebAssembly and (2) how faithfully WebAssembly compilers preserve code semantics in this new binary. Through a study on 115 open-source codebases, we identify the key challenges in cross-compiling legacy C/C++ code into WebAssembly, highlighting the risks of silent miscompilation and compile-time errors. We categorize these challenges based on their root causes and propose corresponding solutions. We then introduce a differential testing approach, implemented in a framework named WasmChecker, to investigate the semantics equivalency of code between native x86-64 and WebAssembly binaries. Using WasmChecker, we provide a witness that WebAssembly compilers do not necessarily preserve code semantics when cross-compiling high-level language code into WebAssembly due to different implementations of standard libraries, unsupported system calls/APIs, WebAssembly's unique features, and compiler bugs. Furthermore, we have identified 11 new bugs in the Emscripten compiler toolchain, all confirmed by Emscripten developers. As proof of concept, we make our framework and the collected dataset of open-source codebases publicly available.