[Wasm][AOT] register_methods_in_jinfo memory access out of bounds #50202

jeromelaban · 2021-03-24T19:44:14Z

Description

Repro: https://github.com/jeromelaban/Wasm.Samples/tree/master/Bug50202/Bug50202
Faulty dotnet.wasm file: dotnet.wasm.zip

For an unknown reason, the following error happens:

dotnet.js:6766 Unhandled exception in _finalize_startup RuntimeError: memory access out of bounds
    at register_methods_in_jinfo (<anonymous>:wasm-function[7879]:0x14f441)
    at load_aot_module (<anonymous>:wasm-function[5004]:0xbf7de)
    at mono_assembly_invoke_load_hook_internal (<anonymous>:wasm-function[3116]:0x750e0)
    at mono_assembly_request_load_from (<anonymous>:wasm-function[3108]:0x748ad)
    at search_bundle_for_assembly (<anonymous>:wasm-function[4234]:0xa3ec5)
    at netcore_load_reference (<anonymous>:wasm-function[8007]:0x1545f1)
    at mono_assembly_request_byname (<anonymous>:wasm-function[1372]:0x29900)
    at load_image (<anonymous>:wasm-function[1113]:0x237a5)
    at load_aot_module (<anonymous>:wasm-function[5004]:0xbf86d)
    at mono_assembly_invoke_load_hook_internal (<anonymous>:wasm-function[3116]:0x750e0)

This is the location of the error:

runtime/src/mono/mono/mini/aot-runtime.c

Line 1856 in dc5c909

if (mono_bitset_test_fast (registered, start_method)) {

Which is caused by invalid addresses provided by this:

runtime/src/mono/mono/mini/aot-runtime.c

Line 2175 in dc5c909

addr = get_method (i);

Like so:

load_aot_module: System.Net.Http addr=6271 i=944
dotnet.js:1498 load_aot_module: System.Net.Http addr=6272 i=945
dotnet.js:1498 load_aot_module: System.Net.Http addr=6273 i=946
dotnet.js:1498 load_aot_module: System.Net.Http addr=6274 i=947
dotnet.js:1498 load_aot_module: System.Net.Http addr=6275 i=948
dotnet.js:1498 load_aot_module: System.Net.Http addr=6276 i=953
dotnet.js:1498 load_aot_module: System.Net.Http addr=948 i=954
dotnet.js:1498 load_aot_module: System.Net.Http addr=-2130634233 i=955
dotnet.js:1498 load_aot_module: System.Net.Http addr=84 i=956
dotnet.js:1498 load_aot_module: System.Net.Http addr=654377216 i=958
dotnet.js:1498 load_aot_module: System.Net.Http addr=37290241 i=959

Configuration

2f6c5d6

Regression?

Maybe?

Other information

The text was updated successfully, but these errors were encountered:

ghost · 2021-03-24T19:44:19Z

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Issue Details

Description

Repro is coming.

For an unknown reason, the following error happens:

dotnet.js:6766 Unhandled exception in _finalize_startup RuntimeError: memory access out of bounds
    at register_methods_in_jinfo (<anonymous>:wasm-function[7879]:0x14f441)
    at load_aot_module (<anonymous>:wasm-function[5004]:0xbf7de)
    at mono_assembly_invoke_load_hook_internal (<anonymous>:wasm-function[3116]:0x750e0)
    at mono_assembly_request_load_from (<anonymous>:wasm-function[3108]:0x748ad)
    at search_bundle_for_assembly (<anonymous>:wasm-function[4234]:0xa3ec5)
    at netcore_load_reference (<anonymous>:wasm-function[8007]:0x1545f1)
    at mono_assembly_request_byname (<anonymous>:wasm-function[1372]:0x29900)
    at load_image (<anonymous>:wasm-function[1113]:0x237a5)
    at load_aot_module (<anonymous>:wasm-function[5004]:0xbf86d)
    at mono_assembly_invoke_load_hook_internal (<anonymous>:wasm-function[3116]:0x750e0)

This is the location of the error:

runtime/src/mono/mono/mini/aot-runtime.c

Line 1856 in dc5c909

if (mono_bitset_test_fast (registered, start_method)) {

Which is caused by invalid addresses provided by this:

runtime/src/mono/mono/mini/aot-runtime.c

Line 2175 in dc5c909

addr = get_method (i);

Like so:

load_aot_module: System.Net.Http addr=6271 i=944
dotnet.js:1498 load_aot_module: System.Net.Http addr=6272 i=945
dotnet.js:1498 load_aot_module: System.Net.Http addr=6273 i=946
dotnet.js:1498 load_aot_module: System.Net.Http addr=6274 i=947
dotnet.js:1498 load_aot_module: System.Net.Http addr=6275 i=948
dotnet.js:1498 load_aot_module: System.Net.Http addr=6276 i=953
dotnet.js:1498 load_aot_module: System.Net.Http addr=948 i=954
dotnet.js:1498 load_aot_module: System.Net.Http addr=-2130634233 i=955
dotnet.js:1498 load_aot_module: System.Net.Http addr=84 i=956
dotnet.js:1498 load_aot_module: System.Net.Http addr=654377216 i=958
dotnet.js:1498 load_aot_module: System.Net.Http addr=37290241 i=959

Configuration

2f6c5d6

Regression?

Maybe?

Other information

Author:	jeromelaban
Assignees:	-
Labels:	`area-System.Net.Http`, `untriaged`
Milestone:	-

ghost · 2021-03-24T21:59:13Z

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

Description

Repro: https://github.com/jeromelaban/Wasm.Samples/tree/master/Bug50202/Bug50202
Faulty dotnet.wasm file: dotnet.wasm.zip

For an unknown reason, the following error happens:

dotnet.js:6766 Unhandled exception in _finalize_startup RuntimeError: memory access out of bounds
    at register_methods_in_jinfo (<anonymous>:wasm-function[7879]:0x14f441)
    at load_aot_module (<anonymous>:wasm-function[5004]:0xbf7de)
    at mono_assembly_invoke_load_hook_internal (<anonymous>:wasm-function[3116]:0x750e0)
    at mono_assembly_request_load_from (<anonymous>:wasm-function[3108]:0x748ad)
    at search_bundle_for_assembly (<anonymous>:wasm-function[4234]:0xa3ec5)
    at netcore_load_reference (<anonymous>:wasm-function[8007]:0x1545f1)
    at mono_assembly_request_byname (<anonymous>:wasm-function[1372]:0x29900)
    at load_image (<anonymous>:wasm-function[1113]:0x237a5)
    at load_aot_module (<anonymous>:wasm-function[5004]:0xbf86d)
    at mono_assembly_invoke_load_hook_internal (<anonymous>:wasm-function[3116]:0x750e0)

This is the location of the error:

runtime/src/mono/mono/mini/aot-runtime.c

Line 1856 in dc5c909

if (mono_bitset_test_fast (registered, start_method)) {

Which is caused by invalid addresses provided by this:

runtime/src/mono/mono/mini/aot-runtime.c

Line 2175 in dc5c909

addr = get_method (i);

Like so:

load_aot_module: System.Net.Http addr=6271 i=944
dotnet.js:1498 load_aot_module: System.Net.Http addr=6272 i=945
dotnet.js:1498 load_aot_module: System.Net.Http addr=6273 i=946
dotnet.js:1498 load_aot_module: System.Net.Http addr=6274 i=947
dotnet.js:1498 load_aot_module: System.Net.Http addr=6275 i=948
dotnet.js:1498 load_aot_module: System.Net.Http addr=6276 i=953
dotnet.js:1498 load_aot_module: System.Net.Http addr=948 i=954
dotnet.js:1498 load_aot_module: System.Net.Http addr=-2130634233 i=955
dotnet.js:1498 load_aot_module: System.Net.Http addr=84 i=956
dotnet.js:1498 load_aot_module: System.Net.Http addr=654377216 i=958
dotnet.js:1498 load_aot_module: System.Net.Http addr=37290241 i=959

Configuration

2f6c5d6

Regression?

Maybe?

Other information

Author:	jeromelaban
Assignees:	-
Labels:	`arch-wasm`, `area-System.Net.Http`, `untriaged`
Milestone:	-

…) functions, they can happen since mini-llvm.c and aot-compiler.c can compute different table sizes. Fixes dotnet#50202.

…) functions, they (#50217) can happen since mini-llvm.c and aot-compiler.c can compute different table sizes. Fixes #50202.

dotnet-issue-labeler bot added area-System.Net.Http untriaged New issue has not been triaged by the area owner labels Mar 24, 2021

jeromelaban added a commit to jeromelaban/Wasm.Samples that referenced this issue Mar 24, 2021

repro for dotnet/runtime#50202

82f7b99

jeromelaban mentioned this issue Mar 24, 2021

[WebAssembly] .NET 5 support unoplatform/uno#4613

Closed

marek-safar added the arch-wasm WebAssembly architecture label Mar 24, 2021

vargaz mentioned this issue Mar 24, 2021

[mono][aot] Handle out of range indexes in the generated get_method () functions, they can happen since mini-llvm.c and aot-compiler.c can compute different table sizes. #50217

Merged

ghost added the in-pr There is an active PR which will close this issue when it is merged label Mar 24, 2021

vargaz added a commit to vargaz/runtime that referenced this issue Mar 25, 2021

[mono][aot] Handle out of range indexes in the generated get_method (…

ddf23f9

…) functions, they can happen since mini-llvm.c and aot-compiler.c can compute different table sizes. Fixes dotnet#50202.

vargaz closed this as completed in #50217 Apr 9, 2021

vargaz added a commit that referenced this issue Apr 9, 2021

[mono][aot] Handle out of range indexes in the generated get_method (…

83b8058

…) functions, they (#50217) can happen since mini-llvm.c and aot-compiler.c can compute different table sizes. Fixes #50202.

ghost removed the in-pr There is an active PR which will close this issue when it is merged label Apr 9, 2021

ghost locked as resolved and limited conversation to collaborators May 9, 2021

karelz added this to the 6.0.0 milestone May 20, 2021

karelz removed the untriaged New issue has not been triaged by the area owner label Oct 20, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Wasm][AOT] register_methods_in_jinfo memory access out of bounds #50202

[Wasm][AOT] register_methods_in_jinfo memory access out of bounds #50202

jeromelaban commented Mar 24, 2021 •

edited

Loading

ghost commented Mar 24, 2021

Description

Configuration

Regression?

Other information

ghost commented Mar 24, 2021

Description

Configuration

Regression?

Other information

[Wasm][AOT] register_methods_in_jinfo memory access out of bounds #50202

[Wasm][AOT] register_methods_in_jinfo memory access out of bounds #50202

Comments

jeromelaban commented Mar 24, 2021 • edited Loading

Description

Configuration

Regression?

Other information

ghost commented Mar 24, 2021

Description

Configuration

Regression?

Other information

ghost commented Mar 24, 2021

Description

Configuration

Regression?

Other information

jeromelaban commented Mar 24, 2021 •

edited

Loading