Execution of unreachable instruction invoking func(list<variant>)

[ethanstanley3]

Description

echo "`wit-bindgen-go version` | `tinygo version` | `wasmtime --version` | `uname -m`"
wit-bindgen-go version v0.5.0 | tinygo version 0.35.0 darwin/arm64 (using go version go1.23.4 and LLVM version 18.1.2) | wasmtime 28.0.1 (1bdf2c2b5 2025-01-14) | arm64

Execution of a component created using wit-bindgen-go and tinygo hits an unreachable instruction. The component is a composition of two components, host and guest, that target the following worlds:

world guest {
  ... wasi imports ...
  
  variant var {
    a(list<u32>),
    b(u64),
  }

  export foo: func(name: list<var>);
}
world host {
  ... wasi imports...

  variant var {
    a(list<u32>),
    b(u64),
  }

  import foo: func(name: list<var>);

  export wasi:cli/run@0.2.0;
}

Below is the Go source of the host component:

package main

import (
        "go.bytecodealliance.org/cm"
        "example.com/reproduce/host/ns/pkg/host"
)

func main() {
        a := host.VarB(0)
        b := host.VarB(2)
        name := cm.ToList([]host.Var{a, b})
        
        host.Foo(name)

        println("hello from host")
}

And the guest component:

package main

import (
	"go.bytecodealliance.org/cm"
	"example.com/reproduce/guest/ns/pkg/guest"
)

func init() {
	guest.Exports.Foo = func(name cm.List[guest.Var]) {
		println("hello from guest")
	}
}

func main() {}

Component Model bindings are generated using wit-bindgen-go. Components are created using tinygo's wasip2 target. The components are composed using wac and executed with Wasmtime.

Steps to reproduce

Here is a zipped directory that reproduces the bug:
go-list-variant-unreachable.zip

1. Unzip go-list-variant-unreachable.zip
2. Build and run with ./verify.sh

Expected behavior

The following message should be written to standard output:

hello from guest
hello from host

Actual behavior

The execution fails. I get the following error message:

Error: failed to run main module `linked.wasm`

Caused by:
    0: failed to invoke `run` function
    1: error while executing at wasm backtrace:
           0:  0x154 - <unknown>!<wasm function 2>
           1: 0x27c80 - wit-component:shim!indirect-$root-foo
           2: 0x151c2 - main!internal/wasi/cli/v0.2.0/run.wasmexport_Run
           3: 0x14ea8 - main!internal/wasi/cli/v0.2.0/run.wasmexport_Run$gowrapper-wasmexport
           4: 0x14439 - main!tinygo_launch
           5: 0x14fd7 - main!runtime.scheduler
           6: 0x14d9e - main!internal/wasi/cli/v0.2.0/run.wasmexport_Run#wasmexport
       note: using the `WASMTIME_BACKTRACE_DETAILS=1` environment variable may show more debugging information
    2: wasm trap: wasm `unreachable` instruction executed

Note: Some changes to the value of b (such as b := host.VarB(0)) cause the execution to succeed.

Additional context

The Go source programs are derived from a test case produced by a differential testing framework for wit-bindgen and wit-bindgen-go. The wit definitions are derived from a test case produced by wit-smith.

[ethanstanley3]

Here is another reduced test case that seems related but behaves differently. Instead of a crash, a function argument is corrupted:
go-variant-list-corrupted.zip

The wit definitions for this case are as follows:

world guest {
  ... wasi imports ...
  
  variant var {
    a(list<u8>),
    b(u64),
  }

  export foo: func() -> var;
}
world host {
  ... wasi imports ...

  variant var {
    a(list<u8>),
    b(u64),
  }

  import foo: func() -> var;

  export wasi:cli/run@0.2.0;
}

Below are the implementations of functions foo and run:

// from guest/main.go
guest.Exports.Foo = func() (result guest.Var) {
	lst := cm.ToList([]uint8{1, 4})
	println("guest:", lst.Len(), lst.Data())
	return guest.VarA(lst)
}

// from host/main.go
func main() {
	foo_ret := host.Foo()
	lst := *foo_ret.A()
	println("host:", lst.Len(), lst.Data())
}

I get the following output from verify.sh:

guest: 0x00000002 0x00030430
host: 0x000101b0 nil

The expected behavior is for guest and host to print the same values.

If this test case turns out to be unrelated to the original report, I am happy to resubmit as a separate issue. Thanks!

[ydnar]

Thanks for the reproduction! I’m going to take a look at the issue.

If you have a moment, can you see if the issue occurs when using/mutating the variant type purely in Go, without crossing the wasm boundary? I’d like to rule out an issue with the ABI lift/lower code.

[ethanstanley3]

Great, thank you!

I haven't been able to reproduce the issues in the first or second test cases without crossing the Wasm boundary.

Here's an experiment based on the first test case where all the binding functions of host and guest are copied into the host component and called directly. cm.LowerList and cm.LiftList are also called directly on the list:

// host/main.go
package main

import (
	"example.com/reproduce/host/ns/pkg/host"
	"go.bytecodealliance.org/cm"
)

// analogous to guest.Exports.Foo(...) in guest.exports.go
func fake_guestFoo(name cm.List[host.Var]) {
	println("fake guest.Foo received:", name.Len(), *name.Slice()[0].B(), *name.Slice()[1].B())
}

// copied from guest.wasm.go
func fake_wasmexport_Foo(name0 *host.Var, name1 uint32) {
	name := cm.LiftList[cm.List[host.Var]]((*host.Var)(name0), (uint32)(name1))
	fake_guestFoo(name)
	return
}

// adapted fom host.wasm.go
func fake_wasmimport_Foo(name0 *host.Var, name1 uint32) {
	// glue wasmimport_Foo and wasmexport_Foo together
	fake_wasmexport_Foo(name0, name1)
}

// copied from host.wit.go
func fake_hostFoo(name cm.List[host.Var]) {
	name0, name1 := cm.LowerList(name)
	fake_wasmimport_Foo((*host.Var)(name0), (uint32)(name1))
	return
}

func main() {
	name := cm.ToList([]host.Var{host.VarB(88), host.VarB(898)})
	println("sending to fake guest.Foo:", name.Len(), *name.Slice()[0].B(), *name.Slice()[1].B())

	// call mocked version of binding code, doesn't cross the wasm boundary
	fake_hostFoo(name)

	// call the lifting and lowering code directly to check if name is corrupted
	println("testing lowering/lifting in real host:")
	println("original:", name.Len(), name.Data())
	name0, name1 := cm.LowerList(name)
	println("lowered:", name1, name0)
	reconstructed_name := cm.LiftList[cm.List[host.Var]]((*host.Var)(name0), (uint32)(name1))
	println("lifted:", reconstructed_name.Len(), reconstructed_name.Data())

	// finally, call the real Foo in guest.wasm
	println("sending name to real guest.Foo")
	host.Foo(name)
}

Running verify.sh shows that name is not corrupted by calling the copied binding functions or by lifting/lowering:

sending to fake guest.Foo: 0x00000002 88 898
fake guest.Foo received: 0x00000002 88 898
testing lowering/lifting in real host:
original: 0x00000002 0x00030420
lowered: 2 0x00030420
lifted: 0x00000002 0x00030420
sending name to real guest.Foo
Error: failed to run main module `linked.wasm`

Caused by:
    0: failed to invoke `run` function
    1: error while executing at wasm backtrace:
           0:  0x154 - <unknown>!<wasm function 2>
           1: 0x21909 - wit-component:shim!indirect-$root-foo
           2: 0x12230 - main!internal/wasi/cli/v0.2.0/run.wasmexport_Run
           3: 0x11bd9 - main!internal/wasi/cli/v0.2.0/run.wasmexport_Run$gowrapper-wasmexport
           4: 0x1152f - main!tinygo_launch
           5: 0x11cec - main!runtime.scheduler
           6: 0x11acf - main!internal/wasi/cli/v0.2.0/run.wasmexport_Run#wasmexport
       note: using the `WASMTIME_BACKTRACE_DETAILS=1` environment variable may show more debugging information
    2: wasm trap: wasm `unreachable` instruction executed

Modifying/using the variant type in the second test case doesn't seem to cause any problems either. Let me know if there is anything else I should try!

[ydnar]

I traced the issue. Package wit incorrectly reports the ABI alignment of list<T> as 64, when it should be 32.

Correcting this fixes the struct layout of the variant in memory from 12 to 16.