WebAssembly Specification Release 1.1 (Draft 2021-12-18) - page 3

::=

. . .

𝑁

−

::=

−

𝑁

−

. . .

| −

. . .

𝑁

−

::=

The latter class defines

uninterpreted

integers, whose signedness interpretation can vary depending on context. In

the abstract syntax, they are represented as unsigned values. However, some operations

convert

them to signed

based on a two’s complement interpretation.

Note:

The main integer types occurring in this specification are

. However,

other sizes occur as auxiliary constructions, e.g., in the definition of

floating-point

numbers.

Conventions

• The meta variables

𝑚, 𝑛, 𝑖

range over integers.

• Numbers may be denoted by simple arithmetics, as in the grammar above. In order to distinguish arithmetics

𝑁

from sequences like

(1)

𝑁

, the latter is distinguished with parentheses.

2.2.3 Floating-Point

Floating-point

data represents 32 or 64 bit values that correspond to the respective binary formats of the

IEEE

754-2019

standard (Section 3.3).

Every value has a

sign

and a

magnitude

. Magnitudes can either be expressed as

normal

numbers of the form

𝑚

.𝑚

𝑚

. . . 𝑚

𝑀

𝑒

, where

𝑒

is the exponent and

𝑚

is the

significand

whose most significant bit

𝑚

, or as a

subnormal

number where the exponent is fixed to the smallest possible value and

𝑚

; among the subnormals

are positive and negative zero values. Since the significands are binary values, normals are represented in the form

(1 +

𝑚

−

𝑀

)

𝑒

, where

𝑀

is the bit width of

𝑚

; similarly for subnormals.

https://ieeexplore.ieee.org/document/8766229

2.2. Values

Possible magnitudes also include the special values

∞

(infinity) and

nan

(

NaN

, not a number). NaN values have a

payload

that describes the mantissa bits in the underlying

binary representation

. No distinction is made between

signalling and quiet NaNs.

::=

f Nmag

| −

f Nmag

::=

(1 +

𝑀

−

𝑀

)

𝑒

(

−

𝐸

−

+ 2

≤

𝑒

≤

𝐸

−

(0 +

𝑀

−

𝑀

)

𝑒

(

𝑒

−

𝐸

−

+ 2)

∞

nan

𝑛

)

(

≤

𝑛 <

𝑀

)

where

𝑀

signif

𝑁

)

and

𝐸

expon

𝑁

)

with

canonical NaN

is a floating-point value

)

where

canon

is a payload whose most significant bit

while all others are

= 2

𝑁

)

−

arithmetic NaN

is a floating-point value

nan

𝑛

)

with

𝑛

≥

canon

, such that the most significant bit is

while all others are arbitrary.

Note:

In the abstract syntax, subnormals are distinguished by the leading 0 of the significand. The exponent

of subnormals has the same value as the smallest possible exponent of a normal number. Only in the

binary

representation

the exponent of a subnormal is encoded differently than the exponent of any normal number.

Conventions

• The meta variable

𝑧

ranges over floating-point values where clear from context.

2.2.4 Vectors

Numeric vectors

are 128-bit values that are processed by vector instructions (also known as

SIMD

instructions,

single instruction multiple data). They are represented in the abstract syntax using

i128

. The interpretation of

lane types (

integer

floating-point

numbers) and lane sizes are determined by the specific instruction operating

on them.

2.2.5 Names

Names

are sequences of

characters

, which are

scalar values

as defined by

(Section 2.4).

::=

(

)

::=

U+00

. . .

U+D7FF

U+E000

. . .

U+10FFFF

Due to the limitations of the

binary format

, the length of a name is bounded by the length of its

UTF-8

encoding.

https://www.unicode.org/versions/latest/

Chapter 2. Structure

Convention

• Characters (Unicode scalar values) are sometimes used interchangeably with natural numbers

𝑛 <

1114112

2.3 Types

Various entities in WebAssembly are classified by types. Types are checked during

validation

instantiation

, and

possibly

execution

2.3.1 Number Types

Number types

classify numeric values.

::=

The types

and

classify 32 and 64 bit integers, respectively. Integers are not inherently signed or unsigned,

their interpretation is determined by individual operations.
The types

f32

and

f64

classify 32 and 64 bit floating-point data, respectively. They correspond to the respective

binary floating-point representations, also known as

single

and

double

precision, as defined by the

IEEE 754-2019

standard (Section 3.3).
Number types are

transparent

, meaning that their bit patterns can be observed. Values of number type can be stored

memories

Conventions

• The notation

𝑡

denotes the

bit width

of a number type

𝑡

. That is,

i32

f32

= 32

and

i64

f64

= 64

2.3.2 Vector Types

Vector types

classify vectors of

numeric

values processed by vector instructions (also known as

SIMD

instructions,

single instruction multiple data).

vectype

::=

The type

corresponds to a 128 bit vector of packed integer or floating-point data. The packed data can be

interpreted as signed or unsigned integers, single or double precision floating-point values, or a single 128 bit type.

The interpretation is determined by individual operations.
Vector types, like

number types

are

transparent

, meaning that their bit patterns can be observed. Values of vector

type can be stored in

memories

Conventions

• The notation

𝑡

for

bit width

extends to vector types as well, that is,

= 128

https://ieeexplore.ieee.org/document/8766229

2.3. Types

2.3.3 Reference Types

Reference types

classify first-class references to objects in the runtime

::=

The type

denotes the infinite union of all references to

functions

, regardless of their

function types

The type

externref

denotes the infinite union of all references to objects owned by the

embedder

and that can be

passed into WebAssembly under this type.
Reference types are

opaque

, meaning that neither their size nor their bit pattern can be observed. Values of reference

type can be stored in

tables

2.3.4 Value Types

Value types

classify the individual values that WebAssembly code can compute with and the values that a variable

accepts. They are either

, or

::=

Conventions

• The meta variable

𝑡

ranges over value types or subclasses thereof where clear from context.

2.3.5 Result Types

Result types

classify the result of

executing instructions

functions

, which is a sequence of values, written with

brackets.

::=

2.3.6 Function Types

Function types

classify the signature of

functions

, mapping a vector of parameters to a vector of results. They are

also used to classify the inputs and outputs of

::=

2.3.7 Limits

Limits

classify the size range of resizeable storage associated with

and

::=

}

If no maximum is given, the respective storage can grow to any size.

Chapter 2. Structure

2.3.8 Memory Types

Memory types

classify linear

memories

and their size range.

memtype

::=

limits

The limits constrain the minimum and optionally the maximum size of a memory. The limits are given in units of

page size

2.3.9 Table Types

Table types

classify

over elements of

within a size range.

::=

Like memories, tables are constrained by limits for their minimum and optionally maximum size. The limits are

given in numbers of entries.

Note:

In future versions of WebAssembly, additional element types may be introduced.

2.3.10 Global Types

Global types

classify

global

variables, which hold a value and can either be mutable or immutable.

::=

::=

2.3.11 External Types

External types

classify

imports

and

external values

with their respective types.

::=

Conventions

The following auxiliary notation is defined for sequences of external types. It filters out entries of a specific kind

in an order-preserving fashion:

•

) = [

]

•

) = [

]

•

) = [

]

•

) = [

]

2.3. Types

2.4 Instructions

WebAssembly code consists of sequences of

instructions

. Its computational model is based on a

stack machine

in that instructions manipulate values on an implicit

operand stack

, consuming (popping) argument values and

producing or returning (pushing) result values.
In addition to dynamic operands from the stack, some instructions also have static

immediate

arguments, typically

indices

or type annotations, which are part of the instruction itself.

Some instructions are

structured

in that they bracket nested sequences of instructions.

The following sections group instructions into a number of different categories.

2.4.1 Numeric Instructions

Numeric instructions provide basic operations over numeric

values

of specific

. These operations closely match

respective operations available in hardware.

::=

::=

i64

i32

i64

i32

sat

f32

f64

f32

. . .

::=

clz

ctz

popcnt

ibinop

::=

add

sub

mul

div

rem

and

xor

shl

shr

rotl

rotr

funop

::=

abs

neg

sqrt

ceil

floor

trunc

nearest

fbinop

::=

add

sub

mul

div

min

max

copysign

itestop

::=

eqz

irelop

::=

frelop

::=

Numeric instructions are divided by

number type

. For each type, several subcategories can be distinguished:

•

Constants

: return a static constant.

•

Unary Operations

: consume one operand and produce one result of the respective type.

•

Binary Operations

: consume two operands and produce one result of the respective type.

•

Tests

: consume one operand of the respective type and produce a Boolean integer result.

•

Comparisons

: consume two operands of the respective type and produce a Boolean integer result.

•

Conversions

: consume a value of one type and produce a result of another (the source type of the conversion

is the one after the “_”).

Some integer instructions come in two flavors, where a signedness annotation

distinguishes whether the operands

are to be

interpreted

unsigned

signed

integers. For the other integer instructions, the use of two’s complement

for the signed interpretation means that they behave the same regardless of signedness.

Chapter 2. Structure

2.4.2 Vector Instructions

Vector instructions (also known as

SIMD

instructions, single data multiple value) provide basic operations over

values

vector type

ishape

::=

i8x16

i16x8

i32x4

i64x2

fshape

::=

f32x4

f64x2

::=

::=

low

high

laneidx

::=

::=

. . .

v128

v128

v128

v128

v128

i8x16

i8x16

i8x16

i16x8

i32x4

i64x2

i8x16

i16x8

i32x4

i64x2

i8x16

i16x8

i32x4

i16x8

i8x16

i16x8

i32x4

i16x8

extend

i8x16

i32x4

extend

i16x8

i64x2

i32x4

i8x16

i16x8

i32x4

i8x16

i16x8

i16x8

mul

i32x4

mul

i64x2

mul

i8x16

i16x8

i16x8

i8x16

i32x4

extmul

i16x8

i64x2

extmul

i32x4

i16x8

extadd

pairwise

i8x16

i32x4

i16x8

i32x4

sat

f32x4

i32x4

trunc

sat

f64x2

zero

f32x4

convert

i32x4

f32x4

demote

f64x2

zero

f64x2

convert

low

i32x4

f64x2

promote

low

f32x4

. . .

vvunop

::=

not

vvbinop

::=

and

andnot

xor

vvternop

::=

bitselect

vvtestop

::=

any

true

vitestop

::=

all

true

virelop

::=

vfrelop

::=

viunop

::=

abs

neg

vibinop

::=

add

sub

viminmaxop

::=

min

max

visatbinop

::=

add

sat

sub

sat

vishiftop

::=

shl

shr

vfunop

::=

abs

neg

sqrt

ceil

floor

trunc

nearest

vfbinop

::=

add

sub

mul

div

min

max

pmin

pmax

2.4. Instructions

Vector instructions have a naming convention involving a prefix that determines how their operands will be inter-

preted. This prefix describes the

shape

of the operand, written

𝑡

𝑁

, and consisting of a packed

numeric type

𝑡

and

the number of

lanes

𝑁

of that type. Operations are performed point-wise on the values of each lane.

Note:

For example, the shape

i32x4

interprets the operand as four

i32

values, packed into an

i128

. The bitwidth

of the numeric type

𝑡

times

𝑁

always is 128.

Instructions prefixed with

v128

do not involve a specific interpretation, and treat the

as an

i128

value or a

vector of 128 individual bits.
Vector instructions can be grouped into several subcategories:

•

Constants

: return a static constant.

•

Unary Operations

: consume one

operand and produce one

result.

•

Binary Operations

: consume two

operands and produce one

result.

•

Ternary Operations

: consume three

operands and produce one

result.

•

Tests

: consume one

operand and produce a Boolean integer result.

•

Shifts

: consume a

operand and a

i32

operand, producing one

result.

•

Splats

: consume a value of numeric type and produce a

result of a specified shape.

•

Extract lanes

: consume a

operand and return the numeric value in a given lane.

•

Replace lanes

: consume a

operand and a numeric value for a given lane, and produce a

result.

Some vector instructions have a signedness annotation

which distinguishes whether the elements in the operands

are to be

interpreted

unsigned

signed

integers. For the other vector instructions, the use of two’s complement

for the signed interpretation means that they behave the same regardless of signedness.

Conventions

Occasionally, it is convenient to group operators together according to the following grammar shorthands:

::=

::=

::=

::=

::=

sat

2.4.3 Reference Instructions

Instructions in this group are concerned with accessing

references

::=

. . .

These instruction produce a null value, check for a null value, or produce a reference to a given function, respec-

tively.

Chapter 2. Structure

2.4.4 Parametric Instructions

Instructions in this group can operate on operands of any

value type

::=

. . .

)

The

drop

instruction simply throws away a single operand.

The

select

instruction selects one of its first two operands based on whether its third operand is zero or not. It may

include a

value type

determining the type of these operands. If missing, the operands must be of

numeric type

Note:

In future versions of WebAssembly, the type annotation on

select

may allow for more than a single value

being selected at the same time.

2.4.5 Variable Instructions

Variable instructions are concerned with access to

local

global

variables.

::=

. . .

These instructions get or set the values of variables, respectively. The

instruction is like

but also

returns its argument.

2.4.6 Table Instructions

Instructions in this group are concerned with tables

table

::=

. . .

The

and

instructions load or store an element in a table, respectively.

The

size

instruction returns the current size of a table. The

grow

instruction grows table by a given

delta and returns the previous size, or

−

if enough space cannot be allocated. It also takes an initialization value

for the newly allocated entries.
The

fill

instruction sets all entries in a range to a given value.

The

copy

instruction copies elements from a source table region to a possibly overlapping destination region;

the first index denotes the destination. The

passive element segment

instruction copies elements from a

into a table. The

elem

drop

instruction prevents further use of a passive element segment. This instruction is

intended to be used as an optimization hint. After an element segment is dropped its elements can no longer be

retrieved, so the memory used by this segment may be freed.
An additional instruction that accesses a table is the

control instruction

call

indirect

2.4. Instructions

2.4.7 Memory Instructions

Instructions in this group are concerned with linear

::=

::=

::=

. . .

v128

v128

i64

i64

v128

v128

v128

v128

zero

v128

zero

v128

splat

v128

lane

v128

lane

Memory is accessed with

load

and

store

instructions for the different

number types

. They all take a

memory

immediate

memarg

that contains an address

offset

and the expected

alignment

(expressed as the exponent of a

power of 2). Integer loads and stores can optionally specify a

storage size

that is smaller than the

bit width

of the

respective value type. In the case of loads, a sign extension mode

is then required to select appropriate behavior.

Vector loads can specify a shape that is half the

bit width

. Each lane is half its usual size, and the sign

extension mode

then specifies how the smaller lane is extended to the larger lane. Alternatively, vector loads

can perform a

splat

, such that only a single lane of the specified storage size is loaded, and the result is duplicated

to all lanes.
The static address offset is added to the dynamic address operand, yielding a 33 bit

effective address

that is the

zero-based index at which the memory is accessed. All values are read and written in

little endian

byte order. A

trap

results if any of the accessed memory bytes lies outside the address range implied by the memory’s current

size.

Note:

Future version of WebAssembly might provide memory instructions with 64 bit address ranges.

The

size

instruction returns the current size of a memory. The

grow

instruction grows memory

by a given delta and returns the previous size, or

−

if enough memory cannot be allocated. Both instructions

operate in units of

page size

The

fill

instruction sets all values in a region to a given byte. The

copy

instruction copies data

from a source memory region to a possibly overlapping destination region. The

instruction copies

data from a

passive data segment

into a memory. The

data

drop

instruction prevents further use of a passive data

segment. This instruction is intended to be used as an optimization hint. After a data segment is dropped its data

can no longer be retrieved, so the memory used by this segment may be freed.

Note:

In the current version of WebAssembly, all memory instructions implicitly operate on

memory index

This restriction may be lifted in future versions.

https://en.wikipedia.org/wiki/Endianness#Little-endian

Chapter 2. Structure

2.4.8 Control Instructions

Instructions in this group affect the flow of control.

::=

::=

. . .

The

instruction does nothing.

The

unreachable

instruction causes an unconditional

trap

The

block

loop

and

instructions are

structured

instructions. They bracket nested sequences of instructions,

called

blocks

, terminated with, or separated by,

end

else

pseudo-instructions. As the grammar prescribes, they

must be well-nested.
A structured instruction can consume

input

and produce

output

on the operand stack according to its annotated

block type

. It is given either as a

type index

that refers to a suitable

function type

, or as an optional

value type

inline,

which is a shorthand for the function type

]

Each structured control instruction introduces an implicit

label

. Labels are targets for branch instructions that

reference them with

label indices

. Unlike with other

index spaces

, indexing of labels is relative by nesting depth,

that is, label

refers to the innermost structured control instruction enclosing the referring branch instruction, while

increasing indices refer to those farther out. Consequently, labels can only be referenced from

within

the associated

structured control instruction. This also implies that branches can only be directed outwards, “breaking” from the

block of the control construct they target. The exact effect depends on that control construct. In case of

block

it is a

forward jump

, resuming execution after the matching

end

. In case of

loop

it is a

backward jump

to the

beginning of the loop.

Note:

This enforces

structured control flow

. Intuitively, a branch targeting a

block

behaves like a

break

statement in most C-like languages, while a branch targeting a

loop

behaves like a

continue

statement.

Branch instructions come in several flavors:

performs an unconditional branch,

performs a conditional

branch, and

structured control instructions

performs an indirect branch through an operand indexing into the label vector that is an

immediate to the instruction, or to a default target if the operand is out of bounds. The

return

instruction is a

shortcut for an unconditional branch to the outermost block, which implicitly is the body of the current function.

Taking a branch

unwinds

the operand stack up to the height where the targeted structured control instruction was

entered. However, branches may additionally consume operands themselves, which they push back on the operand

stack after unwinding. Forward branches require operands according to the output of the targeted block’s type, i.e.,

represent the values produced by the terminated block. Backward branches require operands according to the input

of the targeted block’s type, i.e., represent the values consumed by the restarted block.
The

call

instruction invokes another

function

, consuming the necessary arguments from the stack and returning the

result values of the call. The

call

indirect

instruction calls a function indirectly through an operand indexing into a

table

that is denoted by a

table index

and must have type

funcref

. Since it may contain functions of heterogeneous

type, the callee is dynamically checked against the

function type

indexed by the instruction’s second immediate,

and the call is aborted with a

trap

if it does not match.

2.4. Instructions

2.4.9 Expressions

Function

bodies, initialization values for

globals

, and offsets of

element

data

segments are given as expressions,

which are sequences of

terminated by an

marker.

::=

In some places, validation

restricts

expressions to be

constant

, which limits the set of allowable instructions.

2.5 Modules

WebAssembly programs are organized into

modules

, which are the unit of deployment, loading, and compilation.

A module collects definitions for

, and

. In addition, it can declare

imports

and

exports

and provide initialization in the form of

and

segments, or a

::=

{

}

Each of the vectors – and thus the entire module – may be empty.

2.5.1 Indices

Definitions are referenced with zero-based

indices

. Each class of definition has its own

index space

, as distinguished

by the following classes.

::=

::=

::=

::=

::=

::=

::=

::=

::=

The index space for

and

includes respective

declared in the same

module. The indices of these imports precede the indices of other definitions in the same index space.
Element indices reference

element segments

and data indices reference

data segments

The index space for

locals

is only accessible inside a

function

and includes the parameters of that function, which

precede the local variables.
Label indices reference

inside an instruction sequence.

Chapter 2. Structure

Conventions

• The meta variable

𝑙

ranges over label indices.

• The meta variables

𝑥, 𝑦

range over indices in any of the other index spaces.

• The notation

idx(

𝐴

)

denotes the set of indices from index space

idx

occurring free in

𝐴

. We sometimes

reinterpret this set as the

vector

of its elements.

Note:

For example, if

𝑥

𝑦

)

, then

dataidx

) =

{

𝑥, 𝑦

}

, or equivalently,

the vector

𝑥 𝑦

2.5.2 Types

The

types

component of a module defines a vector of

function types

All function types used in a module must be defined in this component. They are referenced by

type indices

Note:

Future versions of WebAssembly may add additional forms of type definitions.

2.5.3 Functions

The

funcs

component of a module defines a vector of

functions

with the following structure:

::=

The

of a function declares its signature by reference to a

defined in the module. The parameters of the

function are referenced through 0-based

local indices

in the function’s body; they are mutable.

The

locals

declare a vector of mutable local variables and their types. These variables are referenced through

local

indices

in the function’s body. The index of the first local is the smallest index not referencing a parameter.

The

body

is an

instruction

sequence that upon termination must produce a stack matching the function type’s

result

Functions are referenced through

function indices

, starting with the smallest index not referencing a function

im-

port

2.5.4 Tables

The

tables

component of a module defines a vector of

tables

described by their

::=

A table is a vector of opaque values of a particular

reference type

. The

min

size in the

limits

of the table type

specifies the initial size of that table, while its

max

, if present, restricts the size to which it can grow later.

Tables can be initialized through

element segments

Tables are referenced through

table indices

, starting with the smallest index not referencing a table

import

. Most

constructs implicitly reference table index

2.5. Modules

2.5.5 Memories

The

mems

component of a module defines a vector of

linear memories

(or

memories

for short) as described by

their

::=

A memory is a vector of raw uninterpreted bytes. The

min

size in the

limits

of the memory type specifies the initial

size of that memory, while its

max

, if present, restricts the size to which it can grow later. Both are in units of

page

size

Memories can be initialized through

data segments

Memories are referenced through

memory indices

, starting with the smallest index not referencing a memory

im-

port

. Most constructs implicitly reference memory index

Note:

In the current version of WebAssembly, at most one memory may be defined or imported in a single module,

and

all

constructs implicitly reference this memory

. This restriction may be lifted in future versions.

2.5.6 Globals

The

globals

component of a module defines a vector of

global variables

(or

globals

for short):

::=

Each global stores a single value of the given

global type

. Its

type

also specifies whether a global is immutable or

mutable. Moreover, each global is initialized with an

value given by a

constant

initializer

expression

Globals are referenced through

global indices

, starting with the smallest index not referencing a global

import

2.5.7 Element Segments

The initial contents of a table is uninitialized.

Element segments

can be used to initialize a subrange of a table from

a static

vector

of elements.

The

elems

component of a module defines a vector of element segments. Each element segment defines a

reference

and a corresponding list of

constant

element

expressions

Element segments have a mode that identifies them as either

passive

active

, or

declarative

. A passive element

segment’s elements can be copied to a table using the