CABI: trap on misaligned waitable-set.{wait,poll} ptr

design/mvp/CanonicalABI.md

@@ -4063,10 +4063,15 @@ def canon_waitable_set_wait(mem, si, ptr):
 def unpack_event(mem, inst, ptr, e: EventTuple):
   event, p1, p2 = e
   cx = LiftLowerContext(LiftLowerOptions(memory = mem), inst)
+  trap_if(ptr != align_to(ptr, 4))
+  trap_if(ptr + 8 > len(cx.opts.memory))
   store(cx, p1, U32Type(), ptr)
   store(cx, p2, U32Type(), ptr + 4)
   return [event]
 ```
+Note that `ptr` points to an 8-byte region of memory into which the two
+`i32` payloads of the event are stored. `ptr` must be 4-byte-aligned and the
+whole region must be in bounds, trapping otherwise.
 
 
 ### 🔀 `canon waitable-set.poll`

design/mvp/Explainer.md

@@ -1841,7 +1841,8 @@ Lastly, the `task-cancelled` event is never returned by `waitable-set.wait` or
 
 In the Canonical ABI, the `event-code` return value provides the `event`
 discriminant and the case payloads are stored as two contiguous `i32`s at the
-8-byte-aligned address `payload-addr`.
+4-byte-aligned address `payload-addr`, trapping if `payload-addr` is misaligned
+or out of bounds.
 
 For details, see [Waitables and Waitable Sets] in the concurrency explainer and
 [`canon_waitable_set_wait`] in the Canonical ABI explainer.

design/mvp/canonical-abi/definitions.py

@@ -2349,6 +2349,8 @@ def canon_waitable_set_wait(mem, si, ptr):
 def unpack_event(mem, inst, ptr, e: EventTuple):
   event, p1, p2 = e
   cx = LiftLowerContext(LiftLowerOptions(memory = mem), inst)
+  trap_if(ptr != align_to(ptr, 4))
+  trap_if(ptr + 8 > len(cx.opts.memory))
   store(cx, p1, U32Type(), ptr)
   store(cx, p2, U32Type(), ptr + 4)
   return [event]