[wasm-mt] AOT compilation with threading enabled results in out of bounds memory access

[lambdageek]

Compiling with dotnet publish -c Release -p:RunAOTCompilation=true -p:PublishTrimmed=true -p:WasmEnableThreads=true results in crashes at runtime

• Install 7.0.100-rc.2.22462.1 from dotnet/installer

• create a NuGet.config for the dotnet7 feed

   <configuration>
     <packageSources>
       <add key="dotnet7" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet7/nuget/v3/index.json" />
     </packageSources>
   </configuration>

• install the wasm-experimental workload using dotnet workload install wasm-experimental

• create a new app from the wasmbrowser template: dotnet new wasmbrowser

• Publish with threads, AOT and trimming dotnet publish -c Release -p:RunAOTCompilation=true -p:PublishTrimmed=true -p:WasmEnableThreads=true

Result:

dotnet.js:5 Error: [MONO] * Assertion at /__w/1/s/src/mono/mono/metadata/exception.c:64, condition `is_ok (error)' not met, function:mono_exception_new_by_name, (null) assembly:System.Private.CoreLib.dll type:ArgumentException member:(null)

    at ke (dotnet.js:5:509)
    at Object.Ne (dotnet.js:5:792)
    at _mono_wasm_trace_logger (dotnet.js:14:101296)
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
Ne @ dotnet.js:5

Tagging subscribers to this area: @BrzVlad
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Compiling with dotnet publish -c Release -p:RunAOTCompilation=true -p:PublishTrimmed=true -p:WasmEnableThreads=true results in crashes at runtime

• Install 7.0.100-rc.2.22462.1 from dotnet/installer

• create a NuGet.config for the dotnet7 feed

   <configuration>
     <packageSources>
       <add key="dotnet7" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet7/nuget/v3/index.json" />
     </packageSources>
   </configuration>

• install the wasm-experimental workload using dotnet workload install wasm-experimental

• create a new app from the wasmbrowser template: dotnet new wasmbrowser

• Publish with threads, AOT and trimming dotnet publish -c Release -p:RunAOTCompilation=true -p:PublishTrimmed=true -p:WasmEnableThreads=true

Result:

dotnet.js:5 Error: [MONO] * Assertion at /__w/1/s/src/mono/mono/metadata/exception.c:64, condition `is_ok (error)' not met, function:mono_exception_new_by_name, (null) assembly:System.Private.CoreLib.dll type:ArgumentException member:(null)

    at ke (dotnet.js:5:509)
    at Object.Ne (dotnet.js:5:792)
    at _mono_wasm_trace_logger (dotnet.js:14:101296)
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
Ne @ dotnet.js:5

Author:	lambdageek
Assignees:	-
Labels:	area-GC-mono
Milestone:	-

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Compiling with dotnet publish -c Release -p:RunAOTCompilation=true -p:PublishTrimmed=true -p:WasmEnableThreads=true results in crashes at runtime

• Install 7.0.100-rc.2.22462.1 from dotnet/installer

• create a NuGet.config for the dotnet7 feed

   <configuration>
     <packageSources>
       <add key="dotnet7" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet7/nuget/v3/index.json" />
     </packageSources>
   </configuration>

• install the wasm-experimental workload using dotnet workload install wasm-experimental

• create a new app from the wasmbrowser template: dotnet new wasmbrowser

• Publish with threads, AOT and trimming dotnet publish -c Release -p:RunAOTCompilation=true -p:PublishTrimmed=true -p:WasmEnableThreads=true

Result:

dotnet.js:5 Error: [MONO] * Assertion at /__w/1/s/src/mono/mono/metadata/exception.c:64, condition `is_ok (error)' not met, function:mono_exception_new_by_name, (null) assembly:System.Private.CoreLib.dll type:ArgumentException member:(null)

    at ke (dotnet.js:5:509)
    at Object.Ne (dotnet.js:5:792)
    at _mono_wasm_trace_logger (dotnet.js:14:101296)
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
    at :50266/dotnet.wasm
Ne @ dotnet.js:5

Author:	lambdageek
Assignees:	-
Labels:	arch-wasm, area-Codegen-AOT-mono
Milestone:	7.0.0

[lambdageek]

I dont' think it's a trimmer issue: this is in the published System.Private.CoreLib.dll:

    // method line 2189
    .method public hidebysig specialname rtspecialname 
           instance default void '.ctor' ()  cil managed 
    {
        // Method begins at RVA 0x1a7a5
	// Code size 23 (0x17)
	.maxstack 8
	IL_0000:  ldarg.0 
	IL_0001:  call string class System.SR::get_Arg_ArgumentException()
	IL_0006:  call instance void class System.SystemException::'.ctor'(string)
	IL_000b:  ldarg.0 
	IL_000c:  ldc.i4 -2147024809
	IL_0011:  call instance void class System.Exception::set_HResult(int32)
	IL_0016:  ret 
    } // end of method ArgumentException::.ctor

[lambdageek]

Note also that dotnet publish -c Release -p:WasmBuildNative=true -p:PublishTrimmed=true -p:WasmEnableThreads=true works

[lambdageek]

Turns out the problem was that the AOT cross compiler that we build for non-threaded WASM has some struct offsets hardcoded into it that are different on the threaded WASM runtime.

runtime/src/mono/mono/metadata/sgen-client-mono.h

Lines 43 to 48 in ecf9f2f

	#ifdef SGEN_POSIX_STW
	/* This is -1 until the first suspend. */
	int signal;
	/* FIXME: kill this, we only use signals on systems that have rt-posix, which doesn't have issues with duplicates. */
	unsigned int stop_count; /* to catch duplicate signals. */
	#endif

But the good news is those fields are both dead code (they're only ever initialized and never read from).

PR shortly