Uncaught segfault with GC tunables

[alexcrichton]

Reproduction:

$ cargo run -q wast ./tests/spec_testsuite/array_fill.wast -Ogc-heap-may-move=n -Ogc-heap-reservation=0 -Wfunction-references,gc
zsh: segmentation fault  cargo run wast /Users/alex/code/wasmtime/tests/spec_testsuite/array_fill.wast

This first started with #13080, the introduction of GC heap tunables, due to the flags used. Unsure if it's a latent bug exposed by that or caused by that PR itself, but my guess is that PR itself.

[alexcrichton]

Another likely culprit that's the same issue:

Details

(module
  (type (;0;) (func (param i32)))
  (type (;1;) (func (param i32)))
  (type (;2;) (func (param i32)))
  (type (;3;) (func (param i32)))
  (type (;4;) (func (param i32)))
  (type (;5;) (func (param i32)))
  (type (;6;) (func (param i32)))
  (type (;7;) (func (param i32)))
  (type (;8;) (func (result i32)))
  (type (;9;) (func (result i32)))
  (type (;10;) (func (result i32)))
  (type (;11;) (func (result i32)))
  (type (;12;) (func (result i32)))
  (type (;13;) (func (result i32)))
  (type (;14;) (func (result i32)))
  (type (;15;) (func (result i32)))
  (type (;16;) (func (result i32)))
  (type (;17;) (func (param i32 i32)))
  (type (;18;) (func))
  (import "" "check_i32" (func (;0;) (type 17)))
  (tag (;0;) (type 0) (param i32))
  (tag (;1;) (type 1) (param i32))
  (tag (;2;) (type 2) (param i32))
  (tag (;3;) (type 3) (param i32))
  (tag (;4;) (type 4) (param i32))
  (tag (;5;) (type 5) (param i32))
  (tag (;6;) (type 6) (param i32))
  (tag (;7;) (type 7) (param i32))
  (export "run" (func 15))
  (func (;1;) (type 16) (result i32)
    call 2
  )
  (func (;2;) (type 16) (result i32)
    call 3
  )
  (func (;3;) (type 16) (result i32)
    call 4
  )
  (func (;4;) (type 16) (result i32)
    call 5
  )
  (func (;5;) (type 16) (result i32)
    call 6
  )
  (func (;6;) (type 16) (result i32)
    block (result i32) ;; label = @1
      block (type 8) (result i32) ;; label = @2
        try_table (catch 0 0 (;@2;)) ;; label = @3
          call 7
          i32.const 0
          br 2 (;@1;)
        end
        unreachable
      end
      i32.const 4096
      call 0
      i32.const 1
    end
  )
  (func (;7;) (type 18)
    i32.const 4096
    throw 0
  )
  (func (;8;) (type 16) (result i32)
    call 9
  )
  (func (;9;) (type 16) (result i32)
    call 10
  )
  (func (;10;) (type 16) (result i32)
    call 11
  )
  (func (;11;) (type 16) (result i32)
    call 12
  )
  (func (;12;) (type 16) (result i32)
    call 13
  )
  (func (;13;) (type 16) (result i32)
    block (result i32) ;; label = @1
      block (type 8) (result i32) ;; label = @2
        try_table (catch 0 0 (;@2;)) ;; label = @3
          call 14
          i32.const 0
          br 2 (;@1;)
        end
        unreachable
      end
      i32.const 4096
      call 0
      i32.const 1
    end
  )
  (func (;14;) (type 18)
    i32.const 4096
    throw 0
  )
  (func (;15;) (type 16) (result i32)
    (local i32)
    call 1
    local.get 0
    i32.add
    local.set 0
    call 8
    local.get 0
    i32.add
    local.set 0
    local.get 0
  )
)

$ cargo run -- --invoke run -Wunknown-imports-default -Ccollector=null -Ogc-heap-may-move=n -Ogc-heap-reservation=32 -Wexceptions testcase1.wat
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.17s
     Running `target/debug/wasmtime --invoke run -Wunknown-imports-default -Ccollector=null -Ogc-heap-may-move=n -Ogc-heap-reservation=32 -Wexceptions testcase1.wat`
zsh: segmentation fault  cargo run -- --invoke run -Wunknown-imports-default -Ccollector=null

[alexcrichton]

Another likely culprit in the gc_ops fuzzer as of 495df13 (not easily reproducible in the CLI)

gc_ops.txt

[alexcrichton]

Another segfaulting wast:

$ cargo run wast ./tests/spec_testsuite/array.wast -Ogc-heap-may-move=n -Ogc-heap-reservation=1024 -Wfunction-references,gc
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.16s
     Running `target/debug/wasmtime wast ./tests/spec_testsuite/array.wast -Ogc-heap-may-move=n -Ogc-heap-reservation=1024 -Wfunction-references,gc`
zsh: segmentation fault  cargo run wast ./tests/spec_testsuite/array.wast -Ogc-heap-may-move=n