Exception Reference Global Panics Coredump Serialization

[cla7aye15I4nd]

Summary

When WebAssembly coredump capture is enabled, an untrusted module containing a valid exnref global can turn an ordinary guest trap into a Rust panic in the host. Coredump serialization assumes every reference type belongs to the external, function, or anyref families; the exception-reference family reaches an unreachable!() arm instead of being encoded or rejected.

Detail

After the guest traps, WasmCoreDump::_serialize recreates module globals in the core dump. For reference-valued globals it calls r.heap_type().top() and handles only Extern, Func, and Any:

ValType::Ref(r) => match r.heap_type().top() {
    HeapType::Extern => wasm_encoder::ValType::EXTERNREF,
    HeapType::Func => wasm_encoder::ValType::FUNCREF,
    HeapType::Any => wasm_encoder::ValType::Ref(wasm_encoder::RefType::ANYREF),
    ty => unreachable!("not a top type: {ty:?}"),
},

The exception-reference top type is Exn, so a mutable exnref global reaches the final arm. The reproducer enables the existing coredump option and invokes an exported function containing unreachable; no harness or source change is involved.

Reproduce

set -eu
git clone --depth 1 https://github.com/bytecodealliance/wasmtime.git
cd wasmtime
git rev-parse HEAD

cargo build --bin wasmtime --no-default-features \
  --features 'run,wat,cranelift,compile,coredump,clap/default,clap/wrap_help'

cat > exnref-coredump.wat <<'WAT'
(module
  (global (export "g") (mut exnref) (ref.null exn))
  (func (export "trap")
    unreachable))
WAT

set +e
RUST_BACKTRACE=0 ./target/debug/wasmtime run -D coredump=guest.dump \
  --invoke trap exnref-coredump.wat
status=$?
set -e
printf 'exit=%s\n' "$status"

Observed output on the affected HEAD:

3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb

thread 'main' (...) panicked at crates/wasmtime/src/runtime/coredump.rs:194:31:
internal error: entered unreachable code: not a top type: Exn
exit=101