Core Concepts

3.1 Key Terms

A compiled, stateless Wasm binary (code + declarations). Can be cached and shared.

A module plus state: its memories, tables, globals, and resolved imports Typed code (params → results) Linear memory

A contiguous, resizable array of bytes (ArrayBuffer in JS)

A resizable array of references (function or external refs), used for indirect calls

A single typed value (mutable or immutable) Import / Export

The only way a module communicates with its host A runtime error that aborts execution (e.g., out-of-bounds access, divide by zero) Host / Embedder

The environment running Wasm (browser, Node, Wasmtime...)

3.2 The Stack Machine

Instructions pop operands from an implicit value stack and push results. The validator guarantees the stack types are correct at every point.

The stack machine design yields a compact encoding and is easily translated to register-based machine code by engines.

;; computes (2 + 3) * 4
i32.const 2      ;; stack: [2]
i32.const 3      ;; stack: [2, 3]
i32.add          ;; stack: [5]
i32.const 4      ;; stack: [5, 4]
i32.mul          ;; stack: [20]

3.3 Module Structure

Module
├── Types        (function signatures)
├── Imports      (functions, memories, tables, globals, tags from the host)
├── Functions    (declarations → type indices)
├── Tables
├── Memories
├── Globals
├── Exports
├── Start        (optional function run at instantiation)
├── Elements     (table initializers)
├── Data count / Code (function bodies)
├── Data         (memory initializers)
└── Custom sections (name, producers, DWARF debug info, ...)

3.4 Security Model in Brief

Sandboxed: a module can only touch its own linear memory and what's explicitly imported.

Structured control flow: no arbitrary jumps. Return addresses aren't in linear memory (a protected call stack).

Typed indirect calls: signature-checked at runtime. Memory accesses are bounds-checked.

The host decides what capabilities to grant (the capability-based security model, especially in WASI).