From 6bf30577ed79fa4601caba4e42b5c72d5f948d35 Mon Sep 17 00:00:00 2001
From: Alon Zakai <azakai@google.com>
Date: Mon, 20 Jul 2026 09:36:26 -0700
Subject: [PATCH 1/3] fix

---
 src/ir/memory-utils.cpp | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/ir/memory-utils.cpp b/src/ir/memory-utils.cpp
index 6c6a75ebbcb..6bbcf67a03d 100644
--- a/src/ir/memory-utils.cpp
+++ b/src/ir/memory-utils.cpp
@@ -20,6 +20,10 @@
 
 namespace wasm::MemoryUtils {
 
+// When flattening, do not generate a massive segment that will likely just
+// OOM.
+static uint64_t MaxFlatMemorySize = 4ULL * 1024 * 1024 * 1024;
+
 bool isSubType(const Memory& a, const Memory& b) {
   return a.shared == b.shared && a.addressType == b.addressType &&
          a.initial >= b.initial && a.max <= b.max &&
@@ -104,13 +108,16 @@ bool flatten(Module& wasm) {
   }
   for (auto& segment : dataSegments) {
     auto* offset = segment->offset->dynCast<Const>();
-    Index start = offset->value.getInteger();
-    Index size = segment->data.size();
-    Index end;
+    uint64_t start = offset->value.getUnsigned();
+    uint64_t size = segment->data.size();
+    uint64_t end;
     if (std::ckd_add(&end, start, size)) {
       return false;
     }
     if (end > data.size()) {
+      if (end > MaxFlatMemorySize) {
+        return false;
+      }
       data.resize(end);
     }
     std::copy(segment->data.begin(), segment->data.end(), data.begin() + start);

From f43cabb5342aa3e476bece43efea27e67073cc30 Mon Sep 17 00:00:00 2001
From: Alon Zakai <azakai@google.com>
Date: Mon, 20 Jul 2026 09:36:32 -0700
Subject: [PATCH 2/3] test

---
 test/lit/ctor-eval/memory64-massive.wast | 34 ++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 test/lit/ctor-eval/memory64-massive.wast

diff --git a/test/lit/ctor-eval/memory64-massive.wast b/test/lit/ctor-eval/memory64-massive.wast
new file mode 100644
index 00000000000..f4b936cd3d5
--- /dev/null
+++ b/test/lit/ctor-eval/memory64-massive.wast
@@ -0,0 +1,34 @@
+;; NOTE: Assertions have been generated by update_lit_checks.py --all-items and should not be edited.
+;; RUN: wasm-ctor-eval %s --ctors=func --kept-exports=func --quiet -all -S -o - | filecheck %s
+
+;; The empty segment here has a huge offset. We do not flatten it into a
+;; segment full of zeroes that starts at 0 (the flat form), since that would
+;; OOM, so we fail to eval the ctor here.
+
+(module
+ ;; CHECK:      (type $0 (func))
+
+ ;; CHECK:      (memory $mem i64 16 16 shared)
+ (memory $mem i64 16 16 shared)
+
+ ;; CHECK:      (data $data (i64.const 4294968321) "")
+ (data $data (i64.const 4294968321) "")
+
+ ;; CHECK:      (export "func" (func $func))
+
+ ;; CHECK:      (func $func (type $0)
+ ;; CHECK-NEXT: )
+ (func $func (export "func")
+ )
+)
+
+;; CHECK:      (type $0 (func))
+
+;; CHECK:      (memory $mem i64 16 16 shared)
+
+;; CHECK:      (data $data (i64.const 4294968321) "")
+
+;; CHECK:      (export "func" (func $func))
+
+;; CHECK:      (func $func (type $0)
+;; CHECK-NEXT: )

From 4cf5f358cfc527a96ae5885dca550c1e625eee8d Mon Sep 17 00:00:00 2001
From: Alon Zakai <azakai@google.com>
Date: Mon, 20 Jul 2026 09:37:21 -0700
Subject: [PATCH 3/3] go

---
 test/lit/ctor-eval/memory64-massive.wast | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/test/lit/ctor-eval/memory64-massive.wast b/test/lit/ctor-eval/memory64-massive.wast
index f4b936cd3d5..2b9d165a94e 100644
--- a/test/lit/ctor-eval/memory64-massive.wast
+++ b/test/lit/ctor-eval/memory64-massive.wast
@@ -22,13 +22,3 @@
  )
 )
 
-;; CHECK:      (type $0 (func))
-
-;; CHECK:      (memory $mem i64 16 16 shared)
-
-;; CHECK:      (data $data (i64.const 4294968321) "")
-
-;; CHECK:      (export "func" (func $func))
-
-;; CHECK:      (func $func (type $0)
-;; CHECK-NEXT: )