Describe the bug
The attached testcase contains a function that returns a null externref. Instead of printing null externref, AOT mode crashes in aot_loader.c::load_types.
Version
Version: 2.4.3
Commit: 4b306f0
To Reproduce
Steps to reproduce the behavior:
- Compile
iwasm with the following features:
-DWAMR_BUILD_INTERP=0 -DWAMR_BUILD_AOT=1 -DWAMR_BUILD_JIT=0 -DWAMR_BUILD_FAST_JIT=0 -DWAMR_BUILD_FAST_INTERP=0 -DWAMR_BUILD_BULK_MEMORY=1 -DWAMR_BUILD_SIMD=1 -DWAMR_BUILD_REF_TYPES=1 -DWAMR_BUILD_EXTENDED_CONST_EXPR=1 -DWAMR_BUILD_MEMORY64=1 -DWAMR_BUILD_MULTI_MEMORY=0 -DWAMR_BUILD_TAIL_CALL=1 -DWAMR_BUILD_SHARED_MEMORY=1 -DWAMR_BUILD_GC=1 -DWAMR_BUILD_EXCE_HANDLING=0 -DWAMR_BUILD_LIB_PTHREAD=1 -DWAMR_BUILD_LIB_WASI_THREADS=1
- Convert the PoC to wasm:
(module
(func (export "main") (result externref)
ref.null extern
)
)
- Run:
wamrc --bounds-checks=1 -o poc.aot poc.wasm
- Run:
iwasm -f main poc.aot
Expected behavior
Should output null externref or externref.
Actual Result
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2425922==ERROR: AddressSanitizer: SEGV on unknown address 0x502003780078 (pc 0x55555566304a bp 0x7fffffffc620 sp 0x7fffffffc410 T0)
==2425922==The signal is caused by a READ memory access.
#0 0x55555566304a in load_types wasm-micro-runtime/core/iwasm/aot/aot_loader.c:2081
#1 0x55555566c164 in load_type_info wasm-micro-runtime/core/iwasm/aot/aot_loader.c:2209
#2 0x55555566c164 in load_init_data_section wasm-micro-runtime/core/iwasm/aot/aot_loader.c:2588
#3 0x55555566c164 in load_from_sections wasm-micro-runtime/core/iwasm/aot/aot_loader.c:4023
#4 0x555555671105 in load wasm-micro-runtime/core/iwasm/aot/aot_loader.c:4459
#5 0x555555671105 in aot_load_from_aot_file wasm-micro-runtime/core/iwasm/aot/aot_loader.c:4508
#6 0x555555653e6b in wasm_runtime_load_ex wasm-micro-runtime/core/iwasm/common/wasm_runtime_common.c:1527
#7 0x555555653e6b in wasm_runtime_load_ex wasm-micro-runtime/core/iwasm/common/wasm_runtime_common.c:1476
#8 0x555555653fe5 in wasm_runtime_load wasm-micro-runtime/core/iwasm/common/wasm_runtime_common.c:1568
#9 0x55555557a565 in main wasm-micro-runtime/product-mini/platforms/linux/../posix/main.c:950
#10 0x7ffff7c29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#11 0x7ffff7c29e3f in __libc_start_main_impl ../csu/libc-start.c:392
#12 0x55555557c1b4 in _start (wasm-micro-runtime/product-mini/platforms/linux/build/iwasm-2.4.3+0x281b4)
Desktop:
- Arch [x86_64]
- OS [Linux]
- Version [Ubuntu 22.04]
Describe the bug
The attached testcase contains a function that returns a
null externref. Instead of printingnull externref, AOT mode crashes inaot_loader.c::load_types.Version
Version: 2.4.3
Commit: 4b306f0
To Reproduce
Steps to reproduce the behavior:
iwasmwith the following features:wamrc --bounds-checks=1 -o poc.aot poc.wasmiwasm -f main poc.aotExpected behavior
Should output
null externreforexternref.Actual Result
Desktop: