WAMR runtime behaves differently

[teyahb8]

Subject of the issue

I generated a test case and executed it with different runtimes. Wasmtime, Wasmer, Wasmedge, and WAMR's AOT mode all output an "out of bounds" exception. But, WAMR's JIT mode hangs.

Test case

(module
  (type (;0;) (func (result i32 i64 f32 f64 v128 v128 v128 v128)))
  (memory (;0;) 342 49801 shared)
  (global (;0;) v128 v128.const i32x4 0x18196a16 0x9dce6de0 0xf71d9324 0x9dea14ff)
  (global (;1;) (mut i64) i64.const 0)
  (global (;2;) (mut i64) i64.const 0)
  (export "main" (func 0))
  (elem (;0;) declare func)
  (func (;0;) (type 0) (result i32 i64 f32 f64 v128 v128 v128 v128)
    memory.size
    loop (result f64) ;; label = @1
      global.get 0
      i32x4.extract_lane 1
      i64.load32_u offset=21927505 align=2
      i64.const -4678713565707731950
      br 0 (;@1;)
      br 0 (;@1;)
      i64.extend16_s
      i64.sub
      global.get 2
      i64.xor
      global.set 2
      f64.const 0x1.39d28c830c265p-242 (;=0.00000000000000000000000000000000000000000000000000000000000000000000000017345431238823982;)
    end
    i64.reinterpret_f64
    global.get 1
    i64.xor
    global.set 1
    i64.const 1
    f32.const -0x1.c75a6p+82 (;=-8601375500000000000000000;)
    f64.const -nan:0xffffdffffffff (;=NaN;)
    v128.const i32x4 0x11ae59b9 0xa6cb312b 0x89d8d104 0x75257b08
    v128.const i32x4 0x00000000 0x20000000 0xffffffff 0xfbffffff
    v128.const i32x4 0x5e65e5ab 0x358f28da 0x8e027f89 0xd551a012
    v128.const i32x4 0x80000000 0xffffffff 0xffffdfff 0xffffffff
  )
)

Your environment

• Host OS (Ubuntu 22.04)
• WAMR version (2.3.1), platform (Linux), cpu architecture (x86_64), running mode (JIT), etc.

Steps to reproduce

Run: iwasm --heap-size=0 --llvm-jit -f main test.wasm

Expected behavior

Should output "out of bounds" exception.

Actual behavior

Hangs

Extra Info

Can you please confirm? Thanks in advance.

[Septa2112]

I can't reproduce your result. Could you show me more information about the command and upload your wasm binary?

[teyahb8]

Sure. I am building wamr runtime from source using the following cmake options:

cmake -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_JIT=1 -DWAMR_BUILD_LIBC_WASI=0 -DWAMR_BUILD_LIB_PTHREAD=1 -DBUILD_SHARED_LIBS=1 -DLLVM_DIR=/usr/lib/llvm-18/lib/cmake/llvm ..

Test case wasm file:

shrunken_1837681.txt

[Septa2112]

I think the issue is similar with #4481. The out-of-bounds memory access code has been optimized away as dead code by LLVM-JIT. As a result, the out-of-bounds condition cannot be triggered inside the loop, which ultimately causes an infinite loop.

You can refer to the LLVM-JIT dump below for details.

; ModuleID = 'WASM Module'
source_filename = "WASM Module"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"

define i32 @"aot_func#0"(ptr %exec_env, ptr %0, ptr %1, ptr %2, ptr %3, ptr %4, ptr %5, ptr %6) {
func_begin:
  br label %loop0_begin

loop0_begin:                                      ; preds = %loop0_begin, %func_begin
  %terminate_addr = getelementptr inbounds ptr, ptr %exec_env, i64 5
  %terminate_flags = load volatile i32, ptr %terminate_addr, align 4
  %termination_flag = and i32 %terminate_flags, 1
  %flag_terminate = icmp eq i32 %termination_flag, 0
  br i1 %flag_terminate, label %loop0_begin, label %terminate

terminate:                                        ; preds = %loop0_begin
  ret i32 0
}

define void @"aot_func#0_wrapper"() {
func_begin:
  ret void
}

[teyahb8]

Thanks for the clarification.