Skip to content

[BUG] Returning null externref causes type info loading to crash in AOT mode #4927

@teyahb8

Description

@teyahb8

Describe the bug
The attached testcase contains a function that returns a null externref. Instead of printing null externref, AOT mode crashes in aot_loader.c::load_types.

Version
Version: 2.4.3
Commit: 4b306f0

To Reproduce
Steps to reproduce the behavior:

  1. Compile iwasm with the following features:
-DWAMR_BUILD_INTERP=0   -DWAMR_BUILD_AOT=1   -DWAMR_BUILD_JIT=0   -DWAMR_BUILD_FAST_JIT=0   -DWAMR_BUILD_FAST_INTERP=0   -DWAMR_BUILD_BULK_MEMORY=1   -DWAMR_BUILD_SIMD=1   -DWAMR_BUILD_REF_TYPES=1   -DWAMR_BUILD_EXTENDED_CONST_EXPR=1   -DWAMR_BUILD_MEMORY64=1   -DWAMR_BUILD_MULTI_MEMORY=0   -DWAMR_BUILD_TAIL_CALL=1   -DWAMR_BUILD_SHARED_MEMORY=1   -DWAMR_BUILD_GC=1   -DWAMR_BUILD_EXCE_HANDLING=0   -DWAMR_BUILD_LIB_PTHREAD=1   -DWAMR_BUILD_LIB_WASI_THREADS=1
  1. Convert the PoC to wasm:
(module
  (func (export "main") (result externref)
    ref.null extern
  )
)
  1. Run: wamrc --bounds-checks=1 -o poc.aot poc.wasm
  2. Run: iwasm -f main poc.aot

Expected behavior
Should output null externref or externref.

Actual Result

AddressSanitizer:DEADLYSIGNAL
=================================================================
==2425922==ERROR: AddressSanitizer: SEGV on unknown address 0x502003780078 (pc 0x55555566304a bp 0x7fffffffc620 sp 0x7fffffffc410 T0)
==2425922==The signal is caused by a READ memory access.
    #0 0x55555566304a in load_types wasm-micro-runtime/core/iwasm/aot/aot_loader.c:2081
    #1 0x55555566c164 in load_type_info wasm-micro-runtime/core/iwasm/aot/aot_loader.c:2209
    #2 0x55555566c164 in load_init_data_section wasm-micro-runtime/core/iwasm/aot/aot_loader.c:2588
    #3 0x55555566c164 in load_from_sections wasm-micro-runtime/core/iwasm/aot/aot_loader.c:4023
    #4 0x555555671105 in load wasm-micro-runtime/core/iwasm/aot/aot_loader.c:4459
    #5 0x555555671105 in aot_load_from_aot_file wasm-micro-runtime/core/iwasm/aot/aot_loader.c:4508
    #6 0x555555653e6b in wasm_runtime_load_ex wasm-micro-runtime/core/iwasm/common/wasm_runtime_common.c:1527
    #7 0x555555653e6b in wasm_runtime_load_ex wasm-micro-runtime/core/iwasm/common/wasm_runtime_common.c:1476
    #8 0x555555653fe5 in wasm_runtime_load wasm-micro-runtime/core/iwasm/common/wasm_runtime_common.c:1568
    #9 0x55555557a565 in main wasm-micro-runtime/product-mini/platforms/linux/../posix/main.c:950
    #10 0x7ffff7c29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #11 0x7ffff7c29e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #12 0x55555557c1b4 in _start (wasm-micro-runtime/product-mini/platforms/linux/build/iwasm-2.4.3+0x281b4)

Desktop:

  • Arch [x86_64]
  • OS [Linux]
  • Version [Ubuntu 22.04]

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions