WASI unwinding is broken in release

[purplesyringa]

This is target wasm32-wasip1 with panic = "unwind", running on V8. I tried this code:

struct Dropper;

impl Drop for Dropper {
    fn drop(&mut self) {
        let _ = std::panic::catch_unwind(|| {
            std::panic::resume_unwind(Box::new(String::from("About to do some nifty corruption")))
        });
    }
}

fn main() {
    let _dropper = Dropper;
    panic!("Triggering landing pad");
}

I expected to see this happen: a panic message, followed by the process exit.

Instead, this happened:

thread 'main' panicked at src/main.rs:13:5:
Triggering landing pad
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
wasm://wasm/garbage2-65ce2afe6e737f0d.wasm-0003f686:1


RuntimeError: memory access out of bounds
    at garbage2-65ce2afe6e737f0d.wasm.dlfree (wasm://wasm/garbage2-65ce2afe6e737f0d.wasm-0003f686:wasm-function[140]:0x7464)
    at garbage2-65ce2afe6e737f0d.wasm.free (wasm://wasm/garbage2-65ce2afe6e737f0d.wasm-0003f686:wasm-function[139]:0x70bc)
    at garbage2-65ce2afe6e737f0d.wasm.__rdl_dealloc (wasm://wasm/garbage2-65ce2afe6e737f0d.wasm-0003f686:wasm-function[26]:0xe0e)
    at garbage2-65ce2afe6e737f0d.wasm.__rust_dealloc (wasm://wasm/garbage2-65ce2afe6e737f0d.wasm-0003f686:wasm-function[14]:0x577)
    at garbage2-65ce2afe6e737f0d.wasm._ZN3std2rt19lang_start_internal17hfafca2af8f4e8869E (wasm://wasm/garbage2-65ce2afe6e737f0d.wasm-0003f686:wasm-function[72]:0x2b91)
    at garbage2-65ce2afe6e737f0d.wasm.__main_void (wasm://wasm/garbage2-65ce2afe6e737f0d.wasm-0003f686:wasm-function[12]:0x545)
    at garbage2-65ce2afe6e737f0d.wasm._start (wasm://wasm/garbage2-65ce2afe6e737f0d.wasm-0003f686:wasm-function[5]:0x297)
    at WASI.start (node:wasi:136:7)
    at file:///home/purplesyringa/garbage2/wasi.mjs:12:6

Node.js v20.4.0

Meta

rustc --version --verbose:

rustc 1.84.0-nightly (1e4f10ba6 2024-10-29)
binary: rustc
commit-hash: 1e4f10ba6476e48a42a79b9f846a2d9366525b9e
commit-date: 2024-10-29
host: x86_64-unknown-linux-gnu
release: 1.84.0-nightly
LLVM version: 19.1.1

node --version:

v20.4.0

Compile with --release, run with

import { WASI } from "node:wasi";
import { readFile } from "node:fs/promises";

const wasi = new WASI({
    version: "preview1",
    args: process.argv.slice(2),
    env: process.env,
});

const wasm = await WebAssembly.compile(await readFile(process.argv[2]));
const instance = await WebAssembly.instantiate(wasm, wasi.getImportObject());

wasi.start(instance);

I'm not sure if this is a rustc bug, an LLVM bug, or a V8 bug, but I thought this might be important to track.

[purplesyringa]

@rustbot label +A-panic +I-unsound +O-wasi +O-wasm +T-compiler

[workingjubilee]

...I'm not sure this is what we'd usually call unsound, because of the nature of wasm, but it's definitely not supposed to happen either, sooo

@alexcrichton

[purplesyringa]

I'm pretty sure the problem here is type confusion: I throw a String as a second exception, but then somehow catch_unwind catches the first exception, which is a static string (at least, that's the closest explanation I have after playing around with this for a bit). Type confusion's probably close enough to I-unsound.

[alexcrichton]

How did you build this code? Locally I get:

$ rustc foo.rs --target wasm32-wasip1 -C panic=unwind
error: the crate `panic_unwind` does not have the panic strategy `unwind`

error: aborting due to 1 previous error

In general wasm32-wasip1 definitely does not support unwinding at all. What exactly is happening I can try to help determine but I'll need to know how to build the code