  WebAssembly (abbreviated WASM) has emerged as a promising language of the Web
and also been used for a wide spectrum of software applications such as mobile
applications and desktop applications. These applications, named as WASM
applications, commonly run in WASM runtimes. Bugs in WASM runtimes are
frequently reported by developers and cause the crash of WASM applications.
However, these bugs have not been well studied. To fill in the knowledge gap,
we present a systematic study to characterize and detect bugs in WASM runtimes.
We first harvest a dataset of 311 real-world bugs from hundreds of related
posts on GitHub. Based on the collected high-quality bug reports, we distill 31
bug categories of WASM runtimes and summarize their common fix strategies.
Furthermore, we develop a pattern-based bug detection framework to
automatically detect bugs in WASM runtimes. We apply the detection framework to
five popular WASM runtimes and successfully uncover 53 bugs that have never
been reported previously, among which 14 have been confirmed and 6 have been
fixed by runtime developers.
