dotnet / runtime

.NET is a cross-platform runtime for cloud, mobile, desktop, and IoT apps.
https://docs.microsoft.com/dotnet/core/
MIT License
14.61k stars 4.56k forks source link

[Mono/WASM] `Marshal.GetFunctionPointerForDelegate` crashes the runtime #104391

Open SingleAccretion opened 1 week ago

SingleAccretion commented 1 week ago

Reproduction:

> dotnet new wasmconsole
using System;
using System.Runtime.InteropServices;

public unsafe class Program
{
    public static void Main()
    {
        nint fptr = Marshal.GetFunctionPointerForDelegate(new Action(() => Console.WriteLine("Managed method callee")));
        ((delegate* unmanaged<void>)fptr)();
    }
}
> dotnet run

Expected result: no crash. Actual result:

RuntimeError: memory access out of bounds
    at strlen (wasm://wasm/03d4c862:wasm-function[12385]:0x28e52f)
    at get_native_to_interp (wasm://wasm/03d4c862:wasm-function[13709]:0x2b0d0f)
    at mono_wasm_get_native_to_interp_trampoline (wasm://wasm/03d4c862:wasm-function[4997]:0x14a8bb)
    at interp_create_method_pointer (wasm://wasm/03d4c862:wasm-function[155]:0x1a9f2)
    at jit_compile_method_with_opt_cb (wasm://wasm/03d4c862:wasm-function[4749]:0x134c4e)
    at mono_llvm_cpp_catch_exception (wasm://wasm/03d4c862:wasm-function[4999]:0x14a92f)
    at mono_llvm_catch_exception (wasm://wasm/03d4c862:wasm-function[5066]:0x14f5f8)
    at jit_compile_method_with_opt (wasm://wasm/03d4c862:wasm-function[4748]:0x134b5e)
    at mono_jit_compile_method (wasm://wasm/03d4c862:wasm-function[4746]:0x134981)
    at mono_compile_method_checked (wasm://wasm/03d4c862:wasm-function[3628]:0xf908b)
    at mono_delegate_to_ftnptr_impl (wasm://wasm/03d4c862:wasm-function[3142]:0xdb697)
    at ves_icall_System_Runtime_InteropServices_Marshal_GetFunctionPointerForDelegateInternal (wasm://wasm/03d4c862:wasm-function[3268]:0xe45dc)
    at ves_icall_System_Runtime_InteropServices_Marshal_GetFunctionPointerForDelegateInternal_raw (wasm://wasm/03d4c862:wasm-function[2835]:0xcc674)
    at do_icall (wasm://wasm/03d4c862:wasm-function[206]:0x1d577)
    at do_icall_wrapper (wasm://wasm/03d4c862:wasm-function[126]:0x19979)
    at mono_interp_exec_method (wasm://wasm/03d4c862:wasm-function[117]:0xb236)
    at interp_runtime_invoke (wasm://wasm/03d4c862:wasm-function[160]:0x1aed3)
    at mono_jit_runtime_invoke (wasm://wasm/03d4c862:wasm-function[4781]:0x1387a9)
    at do_runtime_invoke (wasm://wasm/03d4c862:wasm-function[3600]:0xf6dfe)
    at mono_runtime_invoke_checked (wasm://wasm/03d4c862:wasm-function[3599]:0xf6d98)
    at mono_runtime_try_invoke_byrefs (wasm://wasm/03d4c862:wasm-function[3697]:0xfd55c)
    at ves_icall_InternalInvoke (wasm://wasm/03d4c862:wasm-function[2620]:0xc15dd)
    at ves_icall_InternalInvoke_raw (wasm://wasm/03d4c862:wasm-function[2783]:0xca1b9)
    at do_icall (wasm://wasm/03d4c862:wasm-function[206]:0x1d64c)
    at do_icall_wrapper (wasm://wasm/03d4c862:wasm-function[126]:0x19979)
    at mono_interp_exec_method (wasm://wasm/03d4c862:wasm-function[117]:0xb236)
    at interp_runtime_invoke (wasm://wasm/03d4c862:wasm-function[160]:0x1aed3)
    at mono_jit_runtime_invoke (wasm://wasm/03d4c862:wasm-function[4781]:0x1387a9)
    at do_runtime_invoke (wasm://wasm/03d4c862:wasm-function[3600]:0xf6dfe)
    at mono_runtime_try_invoke (wasm://wasm/03d4c862:wasm-function[3609]:0xf787d)
    at mono_runtime_invoke (wasm://wasm/03d4c862:wasm-function[3646]:0xfa46c)
    at mono_wasm_invoke_jsexport (wasm://wasm/03d4c862:wasm-function[13673]:0x2af762)

More context: https://github.com/dotnet/runtimelab/issues/2624.

dotnet-policy-service[bot] commented 1 week ago

Tagging subscribers to 'arch-wasm': @lewing See info in area-owners.md if you want to be subscribed.

nazar554 commented 1 week ago

I don't think that it matters here, but isn't GC.KeepAlive required to keep the delegate alive?

SingleAccretion commented 1 week ago

I don't think that it matters here, but isn't GC.KeepAlive required to keep the delegate alive?

Yes, in actual code one needs to keep the delegate alive explicitly.

dotnet-policy-service[bot] commented 1 week ago

Tagging subscribers to this area: @brzvlad, @kotlarmilos See info in area-owners.md if you want to be subscribed.