[wasm-mt] AOT compilation with threading enabled results in out of bounds memory access

Compiling with dotnet publish -c Release -p:RunAOTCompilation=true -p:PublishTrimmed=true -p:WasmEnableThreads=true results in crashes at runtime

Install 7.0.100-rc.2.22462.1 from dotnet/installer

create a NuGet.config for the dotnet7 feed

 <configuration>
   <packageSources>
     <add key="dotnet7" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet7/nuget/v3/index.json" />
   </packageSources>
 </configuration>

install the wasm-experimental workload using dotnet workload install wasm-experimental
create a new app from the wasmbrowser template: dotnet new wasmbrowser
Publish with threads, AOT and trimming dotnet publish -c Release -p:RunAOTCompilation=true -p:PublishTrimmed=true -p:WasmEnableThreads=true

Result:

dotnet.js:5 Error: [MONO] * Assertion at /__w/1/s/src/mono/mono/metadata/exception.c:64, condition `is_ok (error)' not met, function:mono_exception_new_by_name, (null) assembly:System.Private.CoreLib.dll type:ArgumentException member:(null)

    at ke (dotnet.js:5:509)
    at Object.Ne (dotnet.js:5:792)
    at _mono_wasm_trace_logger (dotnet.js:14:101296)
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
Ne @ dotnet.js:5

I dont' think it's a trimmer issue: this is in the published System.Private.CoreLib.dll:

    // method line 2189
    .method public hidebysig specialname rtspecialname 
           instance default void '.ctor' ()  cil managed 
    {
        // Method begins at RVA 0x1a7a5
	// Code size 23 (0x17)
	.maxstack 8
	IL_0000:  ldarg.0 
	IL_0001:  call string class System.SR::get_Arg_ArgumentException()
	IL_0006:  call instance void class System.SystemException::'.ctor'(string)
	IL_000b:  ldarg.0 
	IL_000c:  ldc.i4 -2147024809
	IL_0011:  call instance void class System.Exception::set_HResult(int32)
	IL_0016:  ret 
    } // end of method ArgumentException::.ctor

Note also that dotnet publish -c Release -p:WasmBuildNative=true -p:PublishTrimmed=true -p:WasmEnableThreads=true works

Turns out the problem was that the AOT cross compiler that we build for non-threaded WASM has some struct offsets hardcoded into it that are different on the threaded WASM runtime.

runtime/src/mono/mono/metadata/sgen-client-mono.h

Lines 43 to 48 in ecf9f2f

    
           #ifdef SGEN_POSIX_STW 
        
           	/* This is -1 until the first suspend. */ 
        
           	int signal; 
        
           	/* FIXME: kill this, we only use signals on systems that have rt-posix, which doesn't have issues with duplicates. */ 
        
           	unsigned int stop_count; /* to catch duplicate signals. */ 
        
           #endif

But the good news is those fields are both dead code (they're only ever initialized and never read from).

PR shortly

Navigation Menu

Repository navigation

[wasm-mt] AOT compilation with threading enabled results in out of bounds memory access #75474

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	#ifdef SGEN_POSIX_STW
	/* This is -1 until the first suspend. */
	int signal;
	/* FIXME: kill this, we only use signals on systems that have rt-posix, which doesn't have issues with duplicates. */
	unsigned int stop_count; /* to catch duplicate signals. */
	#endif

[wasm-mt] AOT compilation with threading enabled results in out of bounds memory access #75474

Description

Activity

lambdageek commented on Sep 12, 2022

lambdageek commented on Sep 12, 2022

lambdageek commented on Sep 13, 2022

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions